Information about a list of signals to collect data on.
" } }, + "SignalNodeType": { + "base": null, + "refs": { + "ListSignalCatalogNodesRequest$signalNodeType": "The type of node in the signal catalog.
" + } + }, "SpoolingMode": { "base": null, "refs": { @@ -1578,7 +1584,8 @@ "CreateVehicleRequestItem$attributes": "Static information about a vehicle in a key-value pair. For example: \"engine Type\" : \"v6\"
Static information about a vehicle in a key-value pair. For example:
\"engineType\" : \"1.3 L R2\"
Static information about a vehicle in a key-value pair. For example:
\"engineType\" : \"1.3 L R2\"
Static information about a vehicle in a key-value pair. For example:
\"engineType\" : \"1.3 L R2\"
Static information about a vehicle in a key-value pair. For example:
\"engineType\" : \"1.3 L R2\"
Static information about a vehicle in a key-value pair. For example:
\"engineType\" : \"1.3 L R2\"
The logical expression used to recognize what data to collect. For example, $variable.Vehicle.OutsideAirTemperature >= 105.0.
The logical expression used to recognize what data to collect. For example, $variable.`Vehicle.OutsideAirTemperature` >= 105.0.
Provides information about the access method and settings that are used to retrieve occurrences of sensitive data reported by findings.
", "refs" : { "GetRevealConfigurationResponse$RetrievalConfiguration" : "The access method and settings that are used to retrieve the sensitive data.
", - "UpdateRevealConfigurationResponse$RetrievalConfiguration" : "The access method and settings to use to retrieve the sensitive data.
" + "UpdateRevealConfigurationResponse$RetrievalConfiguration" : "The access method and settings to use when retrieving the sensitive data.
" } }, "RetrievalMode" : { "base" : "The access method to use when retrieving occurrences of sensitive data reported by findings. Valid values are:
", "refs" : { - "RetrievalConfiguration$RetrievalMode" : "The access method that's used when retrieving sensitive data from affected S3 objects. Valid values are: ASSUME_ROLE, assume an IAM role that is in the affected Amazon Web Services account and delegates access to Amazon Macie (roleName); and, CALLER_CREDENTIALS, use the credentials of the IAM user who requests the sensitive data.
", + "RetrievalConfiguration$RetrievalMode" : "The access method that's used to retrieve sensitive data from affected S3 objects. Valid values are: ASSUME_ROLE, assume an IAM role that is in the affected Amazon Web Services account and delegates access to Amazon Macie (roleName); and, CALLER_CREDENTIALS, use the credentials of the IAM user who requests the sensitive data.
", "UpdateRetrievalConfiguration$RetrievalMode" : "The access method to use when retrieving sensitive data from affected S3 objects. Valid values are: ASSUME_ROLE, assume an IAM role that is in the affected Amazon Web Services account and delegates access to Amazon Macie; and, CALLER_CREDENTIALS, use the credentials of the IAM user who requests the sensitive data. If you specify ASSUME_ROLE, also specify the name of an existing IAM role for Macie to assume (roleName).
If you change this value from ASSUME_ROLE to CALLER_CREDENTIALS for an existing configuration, Macie permanently deletes the external ID and role name currently specified for the configuration. These settings can't be recovered after they're deleted.
The status of the configuration for retrieving occurrences of sensitive data reported by findings. Valid values are:
", "refs" : { - "RevealConfiguration$Status" : "The status of the configuration for the Amazon Macie account. In a request, valid values are: ENABLED, enable the configuration for the account; and, DISABLED, disable the configuration for the account. In a response, possible values are: ENABLED, the configuration is currently enabled for the account; and, DISABLED, the configuration is currently disabled for the account.
" + "RevealConfiguration$Status" : "The status of the configuration for the Amazon Macie account. In a response, possible values are: ENABLED, the configuration is currently enabled for the account; and, DISABLED, the configuration is currently disabled for the account. In a request, valid values are: ENABLED, enable the configuration for the account; and, DISABLED, disable the configuration for the account.
If you disable the configuration, you also permanently delete current settings that specify how to access affected S3 objects. If your current access method is ASSUME_ROLE, Macie also deletes the external ID and role name currently specified for the configuration. These settings can't be recovered after they're deleted.
The server-side encryption algorithm that's used by default to encrypt objects that are added to the bucket. Possible values are:
AES256 - New objects are encrypted with an Amazon S3 managed key. They use SSE-S3 encryption.
aws:kms - New objects are encrypted with an KMS key (kmsMasterKeyId), either an Amazon Web Services managed key or a customer managed key. They use SSE-KMS encryption.
NONE - The bucket's default encryption settings don't specify server-side encryption behavior for new objects.
The server-side encryption algorithm that's used by default to encrypt objects that are added to the bucket. Possible values are:
AES256 - New objects use SSE-S3 encryption. They're encrypted with an Amazon S3 managed key.
aws:kms - New objects use SSE-KMS encryption. They're encrypted with an KMS key (kmsMasterKeyId), either an Amazon Web Services managed key or a customer managed key.
aws:kms:dsse - New objects use DSSE-KMS encryption. They're encrypted with an KMS key (kmsMasterKeyId), either an Amazon Web Services managed key or a customer managed key.
NONE - The bucket's default encryption settings don't specify server-side encryption behavior for new objects.
Specifies the access method and settings to use when retrieving occurrences of sensitive data reported by findings. If your request specifies an Identity and Access Management (IAM) role to assume when retrieving the sensitive data, Amazon Macie verifies that the role exists and the attached policies are configured correctly. If there's an issue, Macie returns an error. For information about addressing the issue, see Retrieving sensitive data samples with findings in the Amazon Macie User Guide.
", + "base" : "Specifies the access method and settings to use when retrieving occurrences of sensitive data reported by findings. If your request specifies an Identity and Access Management (IAM) role to assume, Amazon Macie verifies that the role exists and the attached policies are configured correctly. If there's an issue, Macie returns an error. For information about addressing the issue, see Configuration options and requirements for retrieving sensitive data samples in the Amazon Macie User Guide.
", "refs" : { - "UpdateRevealConfigurationRequest$RetrievalConfiguration" : "The access method and settings to use to retrieve the sensitive data.
" + "UpdateRevealConfigurationRequest$RetrievalConfiguration" : "The access method and settings to use when retrieving the sensitive data.
" } }, "UpdateRevealConfigurationRequest" : { - "base" : "Specifies configuration settings for retrieving occurrences of sensitive data reported by findings, and the status of the configuration for an Amazon Macie account. If you don't specify retrievalConfiguration values for an existing configuration, Macie sets the access method to CALLER_CREDENTIALS. If your current access method is ASSUME_ROLE, Macie also deletes the external ID and role name currently specified for the configuration. To keep these settings for an existing configuration, specify the current retrievalConfiguration values in your request.
", + "base" : "Specifies configuration settings for retrieving occurrences of sensitive data reported by findings, and the status of the configuration for an Amazon Macie account. If you don't specify retrievalConfiguration settings for an existing configuration, Macie sets the access method to CALLER_CREDENTIALS. If your current access method is ASSUME_ROLE, Macie also deletes the external ID and role name currently specified for the configuration. To keep these settings for an existing configuration, specify your current retrievalConfiguration settings in your request.
", "refs" : { } }, "UpdateRevealConfigurationResponse" : { @@ -2140,7 +2140,7 @@ "__listOfUnavailabilityReasonCode" : { "base" : null, "refs" : { - "GetSensitiveDataOccurrencesAvailabilityResponse$Reasons" : "Specifies why occurrences of sensitive data can't be retrieved for the finding. Possible values are:
ACCOUNT_NOT_IN_ORGANIZATION - The affected account isn't currently part of your organization. Or the account is part of your organization but Macie isn't currently enabled for the account. You're not allowed to access the affected S3 object by using Macie.
INVALID_CLASSIFICATION_RESULT - There isn't a corresponding sensitive data discovery result for the finding. Or the corresponding sensitive data discovery result isn't available, is malformed or corrupted, or uses an unsupported storage format. Macie can't verify the location of the sensitive data to retrieve.
INVALID_RESULT_SIGNATURE - The corresponding sensitive data discovery result is stored in an S3 object that wasn't signed by Macie. Macie can't verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can't verify the location of the sensitive data to retrieve.
MEMBER_ROLE_TOO_PERMISSIVE - The affected member account is configured to retrieve occurrences of sensitive data by using an IAM role whose trust or permissions policy doesn't meet Macie requirements for restricting access to the role. Or the role's trust policy doesn't specify the correct external ID. Macie can't assume the role to retrieve the sensitive data.
MISSING_GET_MEMBER_PERMISSION - You're not allowed to retrieve information about the association between your account and the affected account. Macie can't determine whether you’re allowed to access the affected S3 object as the delegated Macie administrator for the affected account.
OBJECT_EXCEEDS_SIZE_QUOTA - The storage size of the affected S3 object exceeds the size quota for retrieving occurrences of sensitive data from this type of file.
OBJECT_UNAVAILABLE - The affected S3 object isn't available. The object was renamed, moved, or deleted. Or the object was changed after Macie created the finding.
RESULT_NOT_SIGNED - The corresponding sensitive data discovery result is stored in an S3 object that hasn't been signed. Macie can't verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can't verify the location of the sensitive data to retrieve.
ROLE_TOO_PERMISSIVE - Your account is configured to retrieve occurrences of sensitive data by using an IAM role whose trust or permissions policy doesn't meet Macie requirements for restricting access to the role. Macie can’t assume the role to retrieve the sensitive data.
UNSUPPORTED_FINDING_TYPE - The specified finding isn't a sensitive data finding.
UNSUPPORTED_OBJECT_TYPE - The affected S3 object uses a file or storage format that Macie doesn't support for retrieving occurrences of sensitive data.
This value is null if sensitive data can be retrieved for the finding.
" + "GetSensitiveDataOccurrencesAvailabilityResponse$Reasons" : "Specifies why occurrences of sensitive data can't be retrieved for the finding. Possible values are:
ACCOUNT_NOT_IN_ORGANIZATION - The affected account isn't currently part of your organization. Or the account is part of your organization but Macie isn't currently enabled for the account. You're not allowed to access the affected S3 object by using Macie.
INVALID_CLASSIFICATION_RESULT - There isn't a corresponding sensitive data discovery result for the finding. Or the corresponding sensitive data discovery result isn't available in the current Amazon Web Services Region, is malformed or corrupted, or uses an unsupported storage format. Macie can't verify the location of the sensitive data to retrieve.
INVALID_RESULT_SIGNATURE - The corresponding sensitive data discovery result is stored in an S3 object that wasn't signed by Macie. Macie can't verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can't verify the location of the sensitive data to retrieve.
MEMBER_ROLE_TOO_PERMISSIVE - The trust or permissions policy for the IAM role in the affected member account doesn't meet Macie requirements for restricting access to the role. Or the role's trust policy doesn't specify the correct external ID for your organization. Macie can't assume the role to retrieve the sensitive data.
MISSING_GET_MEMBER_PERMISSION - You're not allowed to retrieve information about the association between your account and the affected account. Macie can't determine whether you’re allowed to access the affected S3 object as the delegated Macie administrator for the affected account.
OBJECT_EXCEEDS_SIZE_QUOTA - The storage size of the affected S3 object exceeds the size quota for retrieving occurrences of sensitive data from this type of file.
OBJECT_UNAVAILABLE - The affected S3 object isn't available. The object was renamed, moved, deleted, or changed after Macie created the finding. Or the object is encrypted with an KMS key that's currently disabled.
RESULT_NOT_SIGNED - The corresponding sensitive data discovery result is stored in an S3 object that hasn't been signed. Macie can't verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can't verify the location of the sensitive data to retrieve.
ROLE_TOO_PERMISSIVE - Your account is configured to retrieve occurrences of sensitive data by using an IAM role whose trust or permissions policy doesn't meet Macie requirements for restricting access to the role. Macie can’t assume the role to retrieve the sensitive data.
UNSUPPORTED_FINDING_TYPE - The specified finding isn't a sensitive data finding.
UNSUPPORTED_OBJECT_TYPE - The affected S3 object uses a file or storage format that Macie doesn't support for retrieving occurrences of sensitive data.
This value is null if sensitive data can be retrieved for the finding.
" } }, "__listOfUnprocessedAccount" : { @@ -2222,7 +2222,7 @@ "BucketCountByEffectivePermission$PubliclyReadable" : "The total number of buckets that allow the general public to have read access to the bucket.
", "BucketCountByEffectivePermission$PubliclyWritable" : "The total number of buckets that allow the general public to have write access to the bucket.
", "BucketCountByEffectivePermission$Unknown" : "The total number of buckets that Amazon Macie wasn't able to evaluate permissions settings for. Macie can't determine whether these buckets are publicly accessible.
", - "BucketCountByEncryptionType$KmsManaged" : "The total number of buckets whose default encryption settings are configured to encrypt new objects with an Amazon Web Services managed KMS key or a customer managed KMS key. By default, these buckets encrypt new objects automatically using SSE-KMS encryption.
", + "BucketCountByEncryptionType$KmsManaged" : "The total number of buckets whose default encryption settings are configured to encrypt new objects with an KMS key, either an Amazon Web Services managed key or a customer managed key. By default, these buckets encrypt new objects automatically using DSSE-KMS or SSE-KMS encryption.
", "BucketCountByEncryptionType$S3Managed" : "The total number of buckets whose default encryption settings are configured to encrypt new objects with an Amazon S3 managed key. By default, these buckets encrypt new objects automatically using SSE-S3 encryption.
", "BucketCountByEncryptionType$Unencrypted" : "The total number of buckets that don't specify default server-side encryption behavior for new objects. Default encryption settings aren't configured for these buckets.
", "BucketCountByEncryptionType$Unknown" : "The total number of buckets that Amazon Macie doesn't have current encryption metadata for. Macie can't provide current data about the default encryption settings for these buckets.
", @@ -2267,9 +2267,9 @@ "MatchingBucket$ObjectCount" : "The total number of objects in the bucket.
", "MatchingBucket$SizeInBytes" : "The total storage size, in bytes, of the bucket.
If versioning is enabled for the bucket, Amazon Macie calculates this value based on the size of the latest version of each object in the bucket. This value doesn't reflect the storage size of all versions of each object in the bucket.
", "MatchingBucket$SizeInBytesCompressed" : "The total storage size, in bytes, of the objects that are compressed (.gz, .gzip, .zip) files in the bucket.
If versioning is enabled for the bucket, Amazon Macie calculates this value based on the size of the latest version of each applicable object in the bucket. This value doesn't reflect the storage size of all versions of each applicable object in the bucket.
", - "ObjectCountByEncryptionType$CustomerManaged" : "The total number of objects that are encrypted with a customer-provided key. The objects use customer-provided server-side encryption (SSE-C).
", - "ObjectCountByEncryptionType$KmsManaged" : "The total number of objects that are encrypted with an KMS key, either an Amazon Web Services managed key or a customer managed key. The objects use KMS encryption (SSE-KMS).
", - "ObjectCountByEncryptionType$S3Managed" : "The total number of objects that are encrypted with an Amazon S3 managed key. The objects use Amazon S3 managed encryption (SSE-S3).
", + "ObjectCountByEncryptionType$CustomerManaged" : "The total number of objects that are encrypted with customer-provided keys. The objects use server-side encryption with customer-provided keys (SSE-C).
", + "ObjectCountByEncryptionType$KmsManaged" : "The total number of objects that are encrypted with KMS keys, either Amazon Web Services managed keys or customer managed keys. The objects use dual-layer server-side encryption or server-side encryption with KMS keys (DSSE-KMS or SSE-KMS).
", + "ObjectCountByEncryptionType$S3Managed" : "The total number of objects that are encrypted with Amazon S3 managed keys. The objects use server-side encryption with Amazon S3 managed keys (SSE-S3).
", "ObjectCountByEncryptionType$Unencrypted" : "The total number of objects that use client-side encryption or aren't encrypted.
", "ObjectCountByEncryptionType$Unknown" : "The total number of objects that Amazon Macie doesn't have current encryption metadata for. Macie can't provide current data about the encryption settings for these objects.
", "ObjectLevelStatistics$FileType" : "The total storage size (in bytes) or number of objects that Amazon Macie can't analyze because the objects don't have a file name extension for a supported file or storage format.
", @@ -2465,7 +2465,7 @@ "ResourceNotFoundException$Message" : "The explanation of the error that occurred.
", "ResourceProfileArtifact$Arn" : "The Amazon Resource Name (ARN) of the object.
", "ResourceProfileArtifact$ClassificationResultStatus" : "The status of the analysis. Possible values are:
COMPLETE - Amazon Macie successfully completed its analysis of the object.
PARTIAL - Macie analyzed only a subset of data in the object. For example, the object is an archive file that contains files in an unsupported format.
SKIPPED - Macie wasn't able to analyze the object. For example, the object is a malformed file.
The external ID to specify in the trust policy for the IAM role to assume when retrieving sensitive data from affected S3 objects (roleName). The trust policy must include an sts:ExternalId condition that requires this ID.
This ID is a unique alphanumeric string that Amazon Macie generates automatically after you configure it to assume a role. This value is null if the value for retrievalMode is CALLER_CREDENTIALS.
", + "RetrievalConfiguration$ExternalId" : "The external ID to specify in the trust policy for the IAM role to assume when retrieving sensitive data from affected S3 objects (roleName). This value is null if the value for retrievalMode is CALLER_CREDENTIALS.
This ID is a unique alphanumeric string that Amazon Macie generates automatically after you configure it to assume an IAM role. For a Macie administrator to retrieve sensitive data from an affected S3 object for a member account, the trust policy for the role in the member account must include an sts:ExternalId condition that requires this ID.
", "S3Bucket$Arn" : "The Amazon Resource Name (ARN) of the bucket.
", "S3Bucket$Name" : "The name of the bucket.
", "S3BucketDefinitionForJob$AccountId" : "The unique identifier for the Amazon Web Services account that owns the buckets.
", @@ -2504,7 +2504,7 @@ "TestCustomDataIdentifierRequest$Regex" : "The regular expression (regex) that defines the pattern to match. The expression can contain as many as 512 characters.
", "TestCustomDataIdentifierRequest$SampleText" : "The sample text to inspect by using the custom data identifier. The text can contain as many as 1,000 characters.
", "ThrottlingException$Message" : "The explanation of the error that occurred.
", - "UnprocessableEntityException$Message" : "The type of error that occurred and prevented Amazon Macie from retrieving occurrences of sensitive data reported by the finding. Possible values are:
ACCOUNT_NOT_IN_ORGANIZATION - The affected account isn't currently part of your organization. Or the account is part of your organization but Macie isn't currently enabled for the account. You're not allowed to access the affected S3 object by using Macie.
INVALID_CLASSIFICATION_RESULT - There isn't a corresponding sensitive data discovery result for the finding. Or the corresponding sensitive data discovery result isn't available, is malformed or corrupted, or uses an unsupported storage format. Macie can't verify the location of the sensitive data to retrieve.
INVALID_RESULT_SIGNATURE - The corresponding sensitive data discovery result is stored in an S3 object that wasn't signed by Macie. Macie can't verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can't verify the location of the sensitive data to retrieve.
MEMBER_ROLE_TOO_PERMISSIVE - The affected member account is configured to retrieve occurrences of sensitive data by using an IAM role whose trust or permissions policy doesn't meet Macie requirements for restricting access to the role. Or the role's trust policy doesn't specify the correct external ID. Macie can't assume the role to retrieve the sensitive data.
MISSING_GET_MEMBER_PERMISSION - You're not allowed to retrieve information about the association between your account and the affected account. Macie can't determine whether you’re allowed to access the affected S3 object as the delegated Macie administrator for the affected account.
OBJECT_EXCEEDS_SIZE_QUOTA - The storage size of the affected S3 object exceeds the size quota for retrieving occurrences of sensitive data from this type of file.
OBJECT_UNAVAILABLE - The affected S3 object isn't available. The object was renamed, moved, or deleted. Or the object was changed after Macie created the finding.
RESULT_NOT_SIGNED - The corresponding sensitive data discovery result is stored in an S3 object that hasn't been signed. Macie can't verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can't verify the location of the sensitive data to retrieve.
ROLE_TOO_PERMISSIVE - Your account is configured to retrieve occurrences of sensitive data by using an IAM role whose trust or permissions policy doesn't meet Macie requirements for restricting access to the role. Macie can’t assume the role to retrieve the sensitive data.
UNSUPPORTED_FINDING_TYPE - The specified finding isn't a sensitive data finding.
UNSUPPORTED_OBJECT_TYPE - The affected S3 object uses a file or storage format that Macie doesn't support for retrieving occurrences of sensitive data.
The type of error that occurred and prevented Amazon Macie from retrieving occurrences of sensitive data reported by the finding. Possible values are:
ACCOUNT_NOT_IN_ORGANIZATION - The affected account isn't currently part of your organization. Or the account is part of your organization but Macie isn't currently enabled for the account. You're not allowed to access the affected S3 object by using Macie.
INVALID_CLASSIFICATION_RESULT - There isn't a corresponding sensitive data discovery result for the finding. Or the corresponding sensitive data discovery result isn't available in the current Amazon Web Services Region, is malformed or corrupted, or uses an unsupported storage format. Macie can't verify the location of the sensitive data to retrieve.
INVALID_RESULT_SIGNATURE - The corresponding sensitive data discovery result is stored in an S3 object that wasn't signed by Macie. Macie can't verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can't verify the location of the sensitive data to retrieve.
MEMBER_ROLE_TOO_PERMISSIVE - The trust or permissions policy for the IAM role in the affected member account doesn't meet Macie requirements for restricting access to the role. Or the role's trust policy doesn't specify the correct external ID for your organization. Macie can't assume the role to retrieve the sensitive data.
MISSING_GET_MEMBER_PERMISSION - You're not allowed to retrieve information about the association between your account and the affected account. Macie can't determine whether you’re allowed to access the affected S3 object as the delegated Macie administrator for the affected account.
OBJECT_EXCEEDS_SIZE_QUOTA - The storage size of the affected S3 object exceeds the size quota for retrieving occurrences of sensitive data from this type of file.
OBJECT_UNAVAILABLE - The affected S3 object isn't available. The object was renamed, moved, deleted, or changed after Macie created the finding. Or the object is encrypted with an KMS key that's currently disabled.
RESULT_NOT_SIGNED - The corresponding sensitive data discovery result is stored in an S3 object that hasn't been signed. Macie can't verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can't verify the location of the sensitive data to retrieve.
ROLE_TOO_PERMISSIVE - Your account is configured to retrieve occurrences of sensitive data by using an IAM role whose trust or permissions policy doesn't meet Macie requirements for restricting access to the role. Macie can’t assume the role to retrieve the sensitive data.
UNSUPPORTED_FINDING_TYPE - The specified finding isn't a sensitive data finding.
UNSUPPORTED_OBJECT_TYPE - The affected S3 object uses a file or storage format that Macie doesn't support for retrieving occurrences of sensitive data.
The Amazon Web Services account ID for the account that the request applies to.
", "UnprocessedAccount$ErrorMessage" : "The reason why the request hasn't been processed.
", "UpdateFindingsFilterRequest$ClientToken" : "A unique, case-sensitive token that you provide to ensure the idempotency of the request.
", diff --git a/models/apis/payment-cryptography/2021-09-14/api-2.json b/models/apis/payment-cryptography/2021-09-14/api-2.json index e9bb9b2a876..7326c64690d 100644 --- a/models/apis/payment-cryptography/2021-09-14/api-2.json +++ b/models/apis/payment-cryptography/2021-09-14/api-2.json @@ -507,6 +507,18 @@ "KeySerialNumber":{"shape":"HexLength20Or24"} } }, + "ExportKeyCryptogram":{ + "type":"structure", + "required":[ + "CertificateAuthorityPublicKeyIdentifier", + "WrappingKeyCertificate" + ], + "members":{ + "CertificateAuthorityPublicKeyIdentifier":{"shape":"KeyArnOrKeyAliasType"}, + "WrappingKeyCertificate":{"shape":"CertificateType"}, + "WrappingSpec":{"shape":"WrappingKeySpec"} + } + }, "ExportKeyInput":{ "type":"structure", "required":[ @@ -522,6 +534,7 @@ "ExportKeyMaterial":{ "type":"structure", "members":{ + "KeyCryptogram":{"shape":"ExportKeyCryptogram"}, "Tr31KeyBlock":{"shape":"ExportTr31KeyBlock"}, "Tr34KeyBlock":{"shape":"ExportTr34KeyBlock"} }, @@ -674,6 +687,22 @@ "min":20, "pattern":"^[0-9A-F]{20}$|^[0-9A-F]{24}$" }, + "ImportKeyCryptogram":{ + "type":"structure", + "required":[ + "Exportable", + "ImportToken", + "KeyAttributes", + "WrappedKeyCryptogram" + ], + "members":{ + "Exportable":{"shape":"Boolean"}, + "ImportToken":{"shape":"ImportTokenId"}, + "KeyAttributes":{"shape":"KeyAttributes"}, + "WrappedKeyCryptogram":{"shape":"WrappedKeyCryptogram"}, + "WrappingSpec":{"shape":"WrappingKeySpec"} + } + }, "ImportKeyInput":{ "type":"structure", "required":["KeyMaterial"], @@ -687,6 +716,7 @@ "ImportKeyMaterial":{ "type":"structure", "members":{ + "KeyCryptogram":{"shape":"ImportKeyCryptogram"}, "RootCertificatePublicKey":{"shape":"RootCertificatePublicKey"}, "Tr31KeyBlock":{"shape":"ImportTr31KeyBlock"}, "Tr34KeyBlock":{"shape":"ImportTr34KeyBlock"}, @@ -845,7 +875,8 @@ "TR34_KEY_BLOCK", "TR31_KEY_BLOCK", "ROOT_PUBLIC_KEY_CERTIFICATE", - "TRUSTED_PUBLIC_KEY_CERTIFICATE" + "TRUSTED_PUBLIC_KEY_CERTIFICATE", + "KEY_CRYPTOGRAM" ] }, "KeyModesOfUse":{ @@ -918,6 +949,7 @@ "TR31_K1_KEY_BLOCK_PROTECTION_KEY", "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT", "TR31_M3_ISO_9797_3_MAC_KEY", + "TR31_M1_ISO_9797_1_MAC_KEY", "TR31_M6_ISO_9797_5_CMAC_KEY", "TR31_M7_HMAC_KEY", "TR31_P0_PIN_ENCRYPTION_KEY", @@ -1206,6 +1238,12 @@ "WrappingKeyArn":{"shape":"KeyArn"} } }, + "WrappedKeyCryptogram":{ + "type":"string", + "max":4096, + "min":16, + "pattern":"^[0-9A-F]+$" + }, "WrappedKeyMaterialFormat":{ "type":"string", "enum":[ @@ -1213,6 +1251,13 @@ "TR31_KEY_BLOCK", "TR34_KEY_BLOCK" ] + }, + "WrappingKeySpec":{ + "type":"string", + "enum":[ + "RSA_OAEP_SHA_256", + "RSA_OAEP_SHA_512" + ] } } } diff --git a/models/apis/payment-cryptography/2021-09-14/docs-2.json b/models/apis/payment-cryptography/2021-09-14/docs-2.json index a20ad1a284f..451a3f79a8e 100644 --- a/models/apis/payment-cryptography/2021-09-14/docs-2.json +++ b/models/apis/payment-cryptography/2021-09-14/docs-2.json @@ -6,13 +6,13 @@ "CreateKey": "Creates an Amazon Web Services Payment Cryptography key, a logical representation of a cryptographic key, that is unique in your account and Amazon Web Services Region. You use keys for cryptographic functions such as encryption and decryption.
In addition to the key material used in cryptographic operations, an Amazon Web Services Payment Cryptography key includes metadata such as the key ARN, key usage, key origin, creation date, description, and key state.
When you create a key, you specify both immutable and mutable data about the key. The immutable data contains key attributes that define the scope and cryptographic operations that you can perform using the key, for example key class (example: SYMMETRIC_KEY), key algorithm (example: TDES_2KEY), key usage (example: TR31_P0_PIN_ENCRYPTION_KEY) and key modes of use (example: Encrypt). For information about valid combinations of key attributes, see Understanding key attributes in the Amazon Web Services Payment Cryptography User Guide. The mutable data contained within a key includes usage timestamp and key deletion timestamp and can be modified after creation.
Amazon Web Services Payment Cryptography binds key attributes to keys using key blocks when you store or export them. Amazon Web Services Payment Cryptography stores the key contents wrapped and never stores or transmits them in the clear.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", "DeleteAlias": "Deletes the alias, but doesn't affect the underlying key.
Each key can have multiple aliases. To get the aliases of all keys, use the ListAliases operation. To change the alias of a key, first use DeleteAlias to delete the current alias and then use CreateAlias to create a new alias. To associate an existing alias with a different key, call UpdateAlias.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", "DeleteKey": "Deletes the key material and metadata associated with Amazon Web Services Payment Cryptography key.
Key deletion is irreversible. After a key is deleted, you can't perform cryptographic operations using the key. For example, you can't decrypt data that was encrypted by a deleted Amazon Web Services Payment Cryptography key, and the data may become unrecoverable. Because key deletion is destructive, Amazon Web Services Payment Cryptography has a safety mechanism to prevent accidental deletion of a key. When you call this operation, Amazon Web Services Payment Cryptography disables the specified key but doesn't delete it until after a waiting period set using DeleteKeyInDays. The default waiting period is 7 days. During the waiting period, the KeyState is DELETE_PENDING. After the key is deleted, the KeyState is DELETE_COMPLETE.
You should delete a key only when you are sure that you don't need to use it anymore and no other parties are utilizing this key. If you aren't sure, consider deactivating it instead by calling StopKeyUsage.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", - "ExportKey": "Exports a key from Amazon Web Services Payment Cryptography.
Amazon Web Services Payment Cryptography simplifies key exchange by replacing the existing paper-based approach with a modern electronic approach. With ExportKey you can export symmetric keys using either symmetric and asymmetric key exchange mechanisms. Using this operation, you can share your Amazon Web Services Payment Cryptography generated keys with other service partners to perform cryptographic operations outside of Amazon Web Services Payment Cryptography
For symmetric key exchange, Amazon Web Services Payment Cryptography uses the ANSI X9 TR-31 norm in accordance with PCI PIN guidelines. And for asymmetric key exchange, Amazon Web Services Payment Cryptography supports ANSI X9 TR-34 norm . Asymmetric key exchange methods are typically used to establish bi-directional trust between the two parties exhanging keys and are used for initial key exchange such as Key Encryption Key (KEK). After which you can export working keys using symmetric method to perform various cryptographic operations within Amazon Web Services Payment Cryptography.
The TR-34 norm is intended for exchanging 3DES keys only and keys are imported in a WrappedKeyBlock format. Key attributes (such as KeyUsage, KeyAlgorithm, KeyModesOfUse, Exportability) are contained within the key block.
You can also use ExportKey functionality to generate and export an IPEK (Initial Pin Encryption Key) from Amazon Web Services Payment Cryptography using either TR-31 or TR-34 export key exchange. IPEK is generated from BDK (Base Derivation Key) and ExportDukptInitialKey attribute KSN (KeySerialNumber). The generated IPEK does not persist within Amazon Web Services Payment Cryptography and has to be re-generated each time during export.
To export KEK or IPEK using TR-34
Using this operation, you can export initial key using TR-34 asymmetric key exchange. You can only export KEK generated within Amazon Web Services Payment Cryptography. In TR-34 terminology, the sending party of the key is called Key Distribution Host (KDH) and the receiving party of the key is called Key Receiving Device (KRD). During key export process, KDH is Amazon Web Services Payment Cryptography which initiates key export and KRD is the user receiving the key.
To initiate TR-34 key export, the KRD must obtain an export token by calling GetParametersForExport. This operation also generates a key pair for the purpose of key export, signs the key and returns back the signing public key certificate (also known as KDH signing certificate) and root certificate chain. The KDH uses the private key to sign the the export payload and the signing public key certificate is provided to KRD to verify the signature. The KRD can import the root certificate into its Hardware Security Module (HSM), as required. The export token and the associated KDH signing certificate expires after 7 days.
Next the KRD generates a key pair for the the purpose of encrypting the KDH key and provides the public key cerificate (also known as KRD wrapping certificate) back to KDH. The KRD will also import the root cerificate chain into Amazon Web Services Payment Cryptography by calling ImportKey for RootCertificatePublicKey. The KDH, Amazon Web Services Payment Cryptography, will use the KRD wrapping cerificate to encrypt (wrap) the key under export and signs it with signing private key to generate a TR-34 WrappedKeyBlock. For more information on TR-34 key export, see section Exporting symmetric keys in the Amazon Web Services Payment Cryptography User Guide.
Set the following parameters:
ExportAttributes: Specify export attributes in case of IPEK export. This parameter is optional for KEK export.
ExportKeyIdentifier: The KeyARN of the KEK or BDK (in case of IPEK) under export.
KeyMaterial: Use Tr34KeyBlock parameters.
CertificateAuthorityPublicKeyIdentifier: The KeyARN of the certificate chain that signed the KRD wrapping key certificate.
ExportToken: Obtained from KDH by calling GetParametersForImport.
WrappingKeyCertificate: The public key certificate in PEM format (base64 encoded) of the KRD wrapping key Amazon Web Services Payment Cryptography uses for encryption of the TR-34 export payload. This certificate must be signed by the root certificate (CertificateAuthorityPublicKeyIdentifier) imported into Amazon Web Services Payment Cryptography.
When this operation is successful, Amazon Web Services Payment Cryptography returns the KEK or IPEK as a TR-34 WrappedKeyBlock.
To export WK (Working Key) or IPEK using TR-31
Using this operation, you can export working keys or IPEK using TR-31 symmetric key exchange. In TR-31, you must use an initial key such as KEK to encrypt or wrap the key under export. To establish a KEK, you can use CreateKey or ImportKey.
Set the following parameters:
ExportAttributes: Specify export attributes in case of IPEK export. This parameter is optional for KEK export.
ExportKeyIdentifier: The KeyARN of the KEK or BDK (in case of IPEK) under export.
KeyMaterial: Use Tr31KeyBlock parameters.
When this operation is successful, Amazon Web Services Payment Cryptography returns the WK or IPEK as a TR-31 WrappedKeyBlock.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", + "ExportKey": "Exports a key from Amazon Web Services Payment Cryptography.
Amazon Web Services Payment Cryptography simplifies key exchange by replacing the existing paper-based approach with a modern electronic approach. With ExportKey you can export symmetric keys using either symmetric and asymmetric key exchange mechanisms. Using this operation, you can share your Amazon Web Services Payment Cryptography generated keys with other service partners to perform cryptographic operations outside of Amazon Web Services Payment Cryptography
For symmetric key exchange, Amazon Web Services Payment Cryptography uses the ANSI X9 TR-31 norm in accordance with PCI PIN guidelines. And for asymmetric key exchange, Amazon Web Services Payment Cryptography supports ANSI X9 TR-34 norm and RSA wrap and unwrap key exchange mechanism. Asymmetric key exchange methods are typically used to establish bi-directional trust between the two parties exhanging keys and are used for initial key exchange such as Key Encryption Key (KEK). After which you can export working keys using symmetric method to perform various cryptographic operations within Amazon Web Services Payment Cryptography.
The TR-34 norm is intended for exchanging 3DES keys only and keys are imported in a WrappedKeyBlock format. Key attributes (such as KeyUsage, KeyAlgorithm, KeyModesOfUse, Exportability) are contained within the key block. With RSA wrap and unwrap, you can exchange both 3DES and AES-128 keys. The keys are imported in a WrappedKeyCryptogram format and you will need to specify the key attributes during import.
You can also use ExportKey functionality to generate and export an IPEK (Initial Pin Encryption Key) from Amazon Web Services Payment Cryptography using either TR-31 or TR-34 export key exchange. IPEK is generated from BDK (Base Derivation Key) and ExportDukptInitialKey attribute KSN (KeySerialNumber). The generated IPEK does not persist within Amazon Web Services Payment Cryptography and has to be re-generated each time during export.
To export initial keys (KEK) or IPEK using TR-34
Using this operation, you can export initial key using TR-34 asymmetric key exchange. You can only export KEK generated within Amazon Web Services Payment Cryptography. In TR-34 terminology, the sending party of the key is called Key Distribution Host (KDH) and the receiving party of the key is called Key Receiving Device (KRD). During key export process, KDH is Amazon Web Services Payment Cryptography which initiates key export and KRD is the user receiving the key.
To initiate TR-34 key export, the KRD must obtain an export token by calling GetParametersForExport. This operation also generates a key pair for the purpose of key export, signs the key and returns back the signing public key certificate (also known as KDH signing certificate) and root certificate chain. The KDH uses the private key to sign the the export payload and the signing public key certificate is provided to KRD to verify the signature. The KRD can import the root certificate into its Hardware Security Module (HSM), as required. The export token and the associated KDH signing certificate expires after 7 days.
Next the KRD generates a key pair for the the purpose of encrypting the KDH key and provides the public key cerificate (also known as KRD wrapping certificate) back to KDH. The KRD will also import the root cerificate chain into Amazon Web Services Payment Cryptography by calling ImportKey for RootCertificatePublicKey. The KDH, Amazon Web Services Payment Cryptography, will use the KRD wrapping cerificate to encrypt (wrap) the key under export and signs it with signing private key to generate a TR-34 WrappedKeyBlock. For more information on TR-34 key export, see section Exporting symmetric keys in the Amazon Web Services Payment Cryptography User Guide.
Set the following parameters:
ExportAttributes: Specify export attributes in case of IPEK export. This parameter is optional for KEK export.
ExportKeyIdentifier: The KeyARN of the KEK or BDK (in case of IPEK) under export.
KeyMaterial: Use Tr34KeyBlock parameters.
CertificateAuthorityPublicKeyIdentifier: The KeyARN of the certificate chain that signed the KRD wrapping key certificate.
ExportToken: Obtained from KDH by calling GetParametersForImport.
WrappingKeyCertificate: The public key certificate in PEM format (base64 encoded) of the KRD wrapping key Amazon Web Services Payment Cryptography uses for encryption of the TR-34 export payload. This certificate must be signed by the root certificate (CertificateAuthorityPublicKeyIdentifier) imported into Amazon Web Services Payment Cryptography.
When this operation is successful, Amazon Web Services Payment Cryptography returns the KEK or IPEK as a TR-34 WrappedKeyBlock.
To export initial keys (KEK) or IPEK using RSA Wrap and Unwrap
Using this operation, you can export initial key using asymmetric RSA wrap and unwrap key exchange method. To initiate export, generate an asymmetric key pair on the receiving HSM and obtain the public key certificate in PEM format (base64 encoded) for the purpose of wrapping and the root certifiate chain. Import the root certificate into Amazon Web Services Payment Cryptography by calling ImportKey for RootCertificatePublicKey.
Next call ExportKey and set the following parameters:
CertificateAuthorityPublicKeyIdentifier: The KeyARN of the certificate chain that signed wrapping key certificate.
KeyMaterial: Set to KeyCryptogram.
WrappingKeyCertificate: The public key certificate in PEM format (base64 encoded) obtained by the receiving HSM and signed by the root certificate (CertificateAuthorityPublicKeyIdentifier) imported into Amazon Web Services Payment Cryptography. The receiving HSM uses its private key component to unwrap the WrappedKeyCryptogram.
When this operation is successful, Amazon Web Services Payment Cryptography returns the WrappedKeyCryptogram.
To export working keys or IPEK using TR-31
Using this operation, you can export working keys or IPEK using TR-31 symmetric key exchange. In TR-31, you must use an initial key such as KEK to encrypt or wrap the key under export. To establish a KEK, you can use CreateKey or ImportKey.
Set the following parameters:
ExportAttributes: Specify export attributes in case of IPEK export. This parameter is optional for KEK export.
ExportKeyIdentifier: The KeyARN of the KEK or BDK (in case of IPEK) under export.
KeyMaterial: Use Tr31KeyBlock parameters.
When this operation is successful, Amazon Web Services Payment Cryptography returns the working key or IPEK as a TR-31 WrappedKeyBlock.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", "GetAlias": "Gets the Amazon Web Services Payment Cryptography key associated with the alias.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", "GetKey": "Gets the key material for an Amazon Web Services Payment Cryptography key, including the immutable and mutable data specified when the key was created.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", "GetParametersForExport": "Gets the export token and the signing key certificate to initiate a TR-34 key export from Amazon Web Services Payment Cryptography.
The signing key certificate signs the wrapped key under export within the TR-34 key payload. The export token and signing key certificate must be in place and operational before calling ExportKey. The export token expires in 7 days. You can use the same export token to export multiple keys from your service account.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", - "GetParametersForImport": "Gets the import token and the wrapping key certificate in PEM format (base64 encoded) to initiate a TR-34 WrappedKeyBlock.
The wrapping key certificate wraps the key under import. The import token and wrapping key certificate must be in place and operational before calling ImportKey. The import token expires in 7 days. You can use the same import token to import multiple keys into your service account.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", + "GetParametersForImport": "Gets the import token and the wrapping key certificate in PEM format (base64 encoded) to initiate a TR-34 WrappedKeyBlock or a RSA WrappedKeyCryptogram import into Amazon Web Services Payment Cryptography.
The wrapping key certificate wraps the key under import. The import token and wrapping key certificate must be in place and operational before calling ImportKey. The import token expires in 7 days. You can use the same import token to import multiple keys into your service account.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", "GetPublicKeyCertificate": "Gets the public key certificate of the asymmetric key pair that exists within Amazon Web Services Payment Cryptography.
Unlike the private key of an asymmetric key, which never leaves Amazon Web Services Payment Cryptography unencrypted, callers with GetPublicKeyCertificate permission can download the public key certificate of the asymmetric key. You can share the public key certificate to allow others to encrypt messages and verify signatures outside of Amazon Web Services Payment Cryptography
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
", - "ImportKey": "Imports symmetric keys and public key certificates in PEM format (base64 encoded) into Amazon Web Services Payment Cryptography.
Amazon Web Services Payment Cryptography simplifies key exchange by replacing the existing paper-based approach with a modern electronic approach. With ImportKey you can import symmetric keys using either symmetric and asymmetric key exchange mechanisms.
For symmetric key exchange, Amazon Web Services Payment Cryptography uses the ANSI X9 TR-31 norm in accordance with PCI PIN guidelines. And for asymmetric key exchange, Amazon Web Services Payment Cryptography supports ANSI X9 TR-34 norm . Asymmetric key exchange methods are typically used to establish bi-directional trust between the two parties exhanging keys and are used for initial key exchange such as Key Encryption Key (KEK) or Zone Master Key (ZMK). After which you can import working keys using symmetric method to perform various cryptographic operations within Amazon Web Services Payment Cryptography.
The TR-34 norm is intended for exchanging 3DES keys only and keys are imported in a WrappedKeyBlock format. Key attributes (such as KeyUsage, KeyAlgorithm, KeyModesOfUse, Exportability) are contained within the key block.
You can also import a root public key certificate, used to sign other public key certificates, or a trusted public key certificate under an already established root public key certificate.
To import a public root key certificate
You can also import a root public key certificate, used to sign other public key certificates, or a trusted public key certificate under an already established root public key certificate.
To import a public root key certificate
Using this operation, you can import the public component (in PEM cerificate format) of your private root key. You can use the imported public root key certificate for digital signatures, for example signing wrapping key or signing key in TR-34, within your Amazon Web Services Payment Cryptography account.
Set the following parameters:
KeyMaterial: RootCertificatePublicKey
KeyClass: PUBLIC_KEY
KeyModesOfUse: Verify
KeyUsage: TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE
PublicKeyCertificate: The public key certificate in PEM format (base64 encoded) of the private root key under import.
To import a trusted public key certificate
The root public key certificate must be in place and operational before you import a trusted public key certificate. Set the following parameters:
KeyMaterial: TrustedCertificatePublicKey
CertificateAuthorityPublicKeyIdentifier: KeyArn of the RootCertificatePublicKey.
KeyModesOfUse and KeyUsage: Corresponding to the cryptographic operations such as wrap, sign, or encrypt that you will allow the trusted public key certificate to perform.
PublicKeyCertificate: The trusted public key certificate in PEM format (base64 encoded) under import.
To import KEK or ZMK using TR-34
Using this operation, you can import initial key using TR-34 asymmetric key exchange. In TR-34 terminology, the sending party of the key is called Key Distribution Host (KDH) and the receiving party of the key is called Key Receiving Device (KRD). During the key import process, KDH is the user who initiates the key import and KRD is Amazon Web Services Payment Cryptography who receives the key.
To initiate TR-34 key import, the KDH must obtain an import token by calling GetParametersForImport. This operation generates an encryption keypair for the purpose of key import, signs the key and returns back the wrapping key certificate (also known as KRD wrapping certificate) and the root certificate chain. The KDH must trust and install the KRD wrapping certificate on its HSM and use it to encrypt (wrap) the KDH key during TR-34 WrappedKeyBlock generation. The import token and associated KRD wrapping certificate expires after 7 days.
Next the KDH generates a key pair for the purpose of signing the encrypted KDH key and provides the public certificate of the signing key to Amazon Web Services Payment Cryptography. The KDH will also need to import the root certificate chain of the KDH signing certificate by calling ImportKey for RootCertificatePublicKey. For more information on TR-34 key import, see section Importing symmetric keys in the Amazon Web Services Payment Cryptography User Guide.
Set the following parameters:
KeyMaterial: Use Tr34KeyBlock parameters.
CertificateAuthorityPublicKeyIdentifier: The KeyARN of the certificate chain that signed the KDH signing key certificate.
ImportToken: Obtained from KRD by calling GetParametersForImport.
WrappedKeyBlock: The TR-34 wrapped key material from KDH. It contains the KDH key under import, wrapped with KRD wrapping certificate and signed by KDH signing private key. This TR-34 key block is typically generated by the KDH Hardware Security Module (HSM) outside of Amazon Web Services Payment Cryptography.
SigningKeyCertificate: The public key certificate in PEM format (base64 encoded) of the KDH signing key generated under the root certificate (CertificateAuthorityPublicKeyIdentifier) imported in Amazon Web Services Payment Cryptography.
To import WK (Working Key) using TR-31
Amazon Web Services Payment Cryptography uses TR-31 symmetric key exchange norm to import working keys. A KEK must be established within Amazon Web Services Payment Cryptography by using TR-34 key import or by using CreateKey. To initiate a TR-31 key import, set the following parameters:
KeyMaterial: Use Tr31KeyBlock parameters.
WrappedKeyBlock: The TR-31 wrapped key material. It contains the key under import, encrypted using KEK. The TR-31 key block is typically generated by a HSM outside of Amazon Web Services Payment Cryptography.
WrappingKeyIdentifier: The KeyArn of the KEK that Amazon Web Services Payment Cryptography uses to decrypt or unwrap the key under import.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", + "ImportKey": "Imports symmetric keys and public key certificates in PEM format (base64 encoded) into Amazon Web Services Payment Cryptography.
Amazon Web Services Payment Cryptography simplifies key exchange by replacing the existing paper-based approach with a modern electronic approach. With ImportKey you can import symmetric keys using either symmetric and asymmetric key exchange mechanisms.
For symmetric key exchange, Amazon Web Services Payment Cryptography uses the ANSI X9 TR-31 norm in accordance with PCI PIN guidelines. And for asymmetric key exchange, Amazon Web Services Payment Cryptography supports ANSI X9 TR-34 norm and RSA wrap and unwrap key exchange mechanisms. Asymmetric key exchange methods are typically used to establish bi-directional trust between the two parties exhanging keys and are used for initial key exchange such as Key Encryption Key (KEK) or Zone Master Key (ZMK). After which you can import working keys using symmetric method to perform various cryptographic operations within Amazon Web Services Payment Cryptography.
The TR-34 norm is intended for exchanging 3DES keys only and keys are imported in a WrappedKeyBlock format. Key attributes (such as KeyUsage, KeyAlgorithm, KeyModesOfUse, Exportability) are contained within the key block. With RSA wrap and unwrap, you can exchange both 3DES and AES-128 keys. The keys are imported in a WrappedKeyCryptogram format and you will need to specify the key attributes during import.
You can also import a root public key certificate, used to sign other public key certificates, or a trusted public key certificate under an already established root public key certificate.
To import a public root key certificate
You can also import a root public key certificate, used to sign other public key certificates, or a trusted public key certificate under an already established root public key certificate.
To import a public root key certificate
Using this operation, you can import the public component (in PEM cerificate format) of your private root key. You can use the imported public root key certificate for digital signatures, for example signing wrapping key or signing key in TR-34, within your Amazon Web Services Payment Cryptography account.
Set the following parameters:
KeyMaterial: RootCertificatePublicKey
KeyClass: PUBLIC_KEY
KeyModesOfUse: Verify
KeyUsage: TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE
PublicKeyCertificate: The public key certificate in PEM format (base64 encoded) of the private root key under import.
To import a trusted public key certificate
The root public key certificate must be in place and operational before you import a trusted public key certificate. Set the following parameters:
KeyMaterial: TrustedCertificatePublicKey
CertificateAuthorityPublicKeyIdentifier: KeyArn of the RootCertificatePublicKey.
KeyModesOfUse and KeyUsage: Corresponding to the cryptographic operations such as wrap, sign, or encrypt that you will allow the trusted public key certificate to perform.
PublicKeyCertificate: The trusted public key certificate in PEM format (base64 encoded) under import.
To import initial keys (KEK or ZMK or similar) using TR-34
Using this operation, you can import initial key using TR-34 asymmetric key exchange. In TR-34 terminology, the sending party of the key is called Key Distribution Host (KDH) and the receiving party of the key is called Key Receiving Device (KRD). During the key import process, KDH is the user who initiates the key import and KRD is Amazon Web Services Payment Cryptography who receives the key.
To initiate TR-34 key import, the KDH must obtain an import token by calling GetParametersForImport. This operation generates an encryption keypair for the purpose of key import, signs the key and returns back the wrapping key certificate (also known as KRD wrapping certificate) and the root certificate chain. The KDH must trust and install the KRD wrapping certificate on its HSM and use it to encrypt (wrap) the KDH key during TR-34 WrappedKeyBlock generation. The import token and associated KRD wrapping certificate expires after 7 days.
Next the KDH generates a key pair for the purpose of signing the encrypted KDH key and provides the public certificate of the signing key to Amazon Web Services Payment Cryptography. The KDH will also need to import the root certificate chain of the KDH signing certificate by calling ImportKey for RootCertificatePublicKey. For more information on TR-34 key import, see section Importing symmetric keys in the Amazon Web Services Payment Cryptography User Guide.
Set the following parameters:
KeyMaterial: Use Tr34KeyBlock parameters.
CertificateAuthorityPublicKeyIdentifier: The KeyARN of the certificate chain that signed the KDH signing key certificate.
ImportToken: Obtained from KRD by calling GetParametersForImport.
WrappedKeyBlock: The TR-34 wrapped key material from KDH. It contains the KDH key under import, wrapped with KRD wrapping certificate and signed by KDH signing private key. This TR-34 key block is typically generated by the KDH Hardware Security Module (HSM) outside of Amazon Web Services Payment Cryptography.
SigningKeyCertificate: The public key certificate in PEM format (base64 encoded) of the KDH signing key generated under the root certificate (CertificateAuthorityPublicKeyIdentifier) imported in Amazon Web Services Payment Cryptography.
To import initial keys (KEK or ZMK or similar) using RSA Wrap and Unwrap
Using this operation, you can import initial key using asymmetric RSA wrap and unwrap key exchange method. To initiate import, call GetParametersForImport with KeyMaterial set to KEY_CRYPTOGRAM to generate an import token. This operation also generates an encryption keypair for the purpose of key import, signs the key and returns back the wrapping key certificate in PEM format (base64 encoded) and its root certificate chain. The import token and associated KRD wrapping certificate expires after 7 days.
You must trust and install the wrapping certificate and its certificate chain on the sending HSM and use it to wrap the key under export for WrappedKeyCryptogram generation. Next call ImportKey with KeyMaterial set to KEY_CRYPTOGRAM and provide the ImportToken and KeyAttributes for the key under import.
To import working keys using TR-31
Amazon Web Services Payment Cryptography uses TR-31 symmetric key exchange norm to import working keys. A KEK must be established within Amazon Web Services Payment Cryptography by using TR-34 key import or by using CreateKey. To initiate a TR-31 key import, set the following parameters:
KeyMaterial: Use Tr31KeyBlock parameters.
WrappedKeyBlock: The TR-31 wrapped key material. It contains the key under import, encrypted using KEK. The TR-31 key block is typically generated by a HSM outside of Amazon Web Services Payment Cryptography.
WrappingKeyIdentifier: The KeyArn of the KEK that Amazon Web Services Payment Cryptography uses to decrypt or unwrap the key under import.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", "ListAliases": "Lists the aliases for all keys in the caller's Amazon Web Services account and Amazon Web Services Region. You can filter the list of aliases. For more information, see Using aliases in the Amazon Web Services Payment Cryptography User Guide.
This is a paginated operation, which means that each response might contain only a subset of all the aliases. When the response contains only a subset of aliases, it includes a NextToken value. Use this value in a subsequent ListAliases request to get more aliases. When you receive a response with no NextToken (or an empty or null value), that means there are no more aliases to get.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", "ListKeys": "Lists the keys in the caller's Amazon Web Services account and Amazon Web Services Region. You can filter the list of keys.
This is a paginated operation, which means that each response might contain only a subset of all the keys. When the response contains only a subset of keys, it includes a NextToken value. Use this value in a subsequent ListKeys request to get more keys. When you receive a response with no NextToken (or an empty or null value), that means there are no more keys to get.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", "ListTagsForResource": "Lists the tags for an Amazon Web Services resource.
This is a paginated operation, which means that each response might contain only a subset of all the tags. When the response contains only a subset of tags, it includes a NextToken value. Use this value in a subsequent ListTagsForResource request to get more tags. When you receive a response with no NextToken (or an empty or null value), that means there are no more tags to get.
Cross-account use: This operation can't be used across different Amazon Web Services accounts.
Related operations:
", @@ -59,6 +59,7 @@ "refs": { "CreateKeyInput$Enabled": "Specifies whether to enable the key. If the key is enabled, it is activated for use within the service. If the key is not enabled, then it is created but not activated. The default value is enabled.
", "CreateKeyInput$Exportable": "Specifies whether the key is exportable from the service.
", + "ImportKeyCryptogram$Exportable": "Specifies whether the key is exportable from the service.
", "ImportKeyInput$Enabled": "Specifies whether import key is enabled.
", "Key$Enabled": "Specifies whether the key is enabled.
", "Key$Exportable": "Specifies whether the key is exportable. This data is immutable after the key is created.
", @@ -69,6 +70,7 @@ "CertificateType": { "base": null, "refs": { + "ExportKeyCryptogram$WrappingKeyCertificate": "The wrapping key certificate in PEM format (base64 encoded). Amazon Web Services Payment Cryptography uses this certificate to wrap the key under export.
", "ExportTr34KeyBlock$WrappingKeyCertificate": "The KeyARN of the wrapping key certificate. Amazon Web Services Payment Cryptography uses this certificate to wrap the key under export.
The signing key certificate in PEM format (base64 encoded) of the public key for signature within the TR-34 key block. The certificate expires after 7 days.
", "GetParametersForExportOutput$SigningKeyCertificateChain": "The root certificate authority (CA) that signed the signing key certificate in PEM format (base64 encoded).
", @@ -144,13 +146,19 @@ "ExportAttributes$ExportDukptInitialKey": "Parameter information for IPEK export.
" } }, + "ExportKeyCryptogram": { + "base": "Parameter information for key material export using asymmetric RSA wrap and unwrap key exchange method.
", + "refs": { + "ExportKeyMaterial$KeyCryptogram": "Parameter information for key material export using asymmetric RSA wrap and unwrap key exchange method
" + } + }, "ExportKeyInput": { "base": null, "refs": { } }, "ExportKeyMaterial": { - "base": "Parameter information for key material export from Amazon Web Services Payment Cryptography using TR-31 or TR-34 key exchange method.
", + "base": "Parameter information for key material export from Amazon Web Services Payment Cryptography using TR-31 or TR-34 or RSA wrap and unwrap key exchange method.
", "refs": { "ExportKeyInput$KeyMaterial": "The key block format type, for example, TR-34 or TR-31, to use during key material export.
" } @@ -242,13 +250,19 @@ "ExportDukptInitialKey$KeySerialNumber": "The KSN for IPEK generation using DUKPT.
KSN must be padded before sending to Amazon Web Services Payment Cryptography. KSN hex length should be 20 for a TDES_2KEY key or 24 for an AES key.
" } }, + "ImportKeyCryptogram": { + "base": "Parameter information for key material import using asymmetric RSA wrap and unwrap key exchange method.
", + "refs": { + "ImportKeyMaterial$KeyCryptogram": "Parameter information for key material import using asymmetric RSA wrap and unwrap key exchange method.
" + } + }, "ImportKeyInput": { "base": null, "refs": { } }, "ImportKeyMaterial": { - "base": "Parameter information for key material import into Amazon Web Services Payment Cryptography using TR-31 or TR-34 key exchange method.
", + "base": "Parameter information for key material import into Amazon Web Services Payment Cryptography using TR-31 or TR-34 or RSA wrap and unwrap key exchange method.
", "refs": { "ImportKeyInput$KeyMaterial": "The key or public key certificate type to use during key material import, for example TR-34 or RootCertificatePublicKey.
" } @@ -262,6 +276,7 @@ "base": null, "refs": { "GetParametersForImportOutput$ImportToken": "The import token to initiate key import into Amazon Web Services Payment Cryptography. The import token expires after 7 days. You can use the same import token to import multiple keys to the same service account.
", + "ImportKeyCryptogram$ImportToken": "The import token that initiates key import using the asymmetric RSA wrap and unwrap key exchange method into AWS Payment Cryptography. It expires after 7 days. You can use the same import token to import multiple keys to the same service account.
", "ImportTr34KeyBlock$ImportToken": "The import token that initiates key import using the asymmetric TR-34 key exchange method into Amazon Web Services Payment Cryptography. It expires after 7 days. You can use the same import token to import multiple keys to the same service account.
" } }, @@ -299,8 +314,8 @@ "refs": { "GetParametersForExportInput$SigningKeyAlgorithm": "The signing key algorithm to generate a signing key certificate. This certificate signs the wrapped key under export within the TR-34 key block. RSA_2048 is the only signing key algorithm allowed.
The algorithm of the signing key certificate for use in TR-34 key block generation. RSA_2048 is the only signing key algorithm allowed.
The wrapping key algorithm to generate a wrapping key certificate. This certificate wraps the key under import.
At this time, RSA_2048, RSA_3072, RSA_4096 are the only allowed algorithms for TR-34 WrappedKeyBlock import.
The algorithm of the wrapping key for use within TR-34 WrappedKeyBlock.
", + "GetParametersForImportInput$WrappingKeyAlgorithm": "The wrapping key algorithm to generate a wrapping key certificate. This certificate wraps the key under import.
At this time, RSA_2048 is the allowed algorithm for TR-34 WrappedKeyBlock import. Additionally, RSA_2048, RSA_3072, RSA_4096 are the allowed algorithms for RSA WrappedKeyCryptogram import.
The algorithm of the wrapping key for use within TR-34 WrappedKeyBlock or RSA WrappedKeyCryptogram.
", "KeyAttributes$KeyAlgorithm": "The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.
For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.
The KeyARN of the key that is scheduled for deletion.
The KeyARN of the certificate chain that signs the wrapping key certificate during RSA wrap and unwrap key export.
The KeyARN of the key under export from Amazon Web Services Payment Cryptography.
The KeyARN of the the wrapping key. This key encrypts or wraps the key under export for TR-31 key block generation.
The KeyARN of the certificate chain that signs the wrapping key certificate during TR-34 key export.
The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.
", "refs": { "CreateKeyInput$KeyAttributes": "The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.
", + "ImportKeyCryptogram$KeyAttributes": null, "Key$KeyAttributes": "The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.
", "KeySummary$KeyAttributes": "The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.
", "RootCertificatePublicKey$KeyAttributes": "The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the root public key is imported.
", @@ -376,7 +393,7 @@ "base": null, "refs": { "GetParametersForExportInput$KeyMaterialType": "The key block format type (for example, TR-34 or TR-31) to use during key material export. Export token is only required for a TR-34 key export, TR34_KEY_BLOCK. Export token is not required for TR-31 key export.
The method to use for key material import. Import token is only required for TR-34 WrappedKeyBlock (TR34_KEY_BLOCK).
Import token is not required for TR-31, root public key cerificate or trusted public key certificate.
" + "GetParametersForImportInput$KeyMaterialType": "The method to use for key material import. Import token is only required for TR-34 WrappedKeyBlock (TR34_KEY_BLOCK) and RSA WrappedKeyCryptogram (KEY_CRYPTOGRAM).
Import token is not required for TR-31, root public key cerificate or trusted public key certificate.
" } }, "KeyModesOfUse": { @@ -666,7 +683,13 @@ "WrappedKey": { "base": "Parameter information for generating a WrappedKeyBlock for key exchange.
", "refs": { - "ExportKeyOutput$WrappedKey": "The key material under export as a TR-34 WrappedKeyBlock or a TR-31 WrappedKeyBlock.
" + "ExportKeyOutput$WrappedKey": "The key material under export as a TR-34 WrappedKeyBlock or a TR-31 WrappedKeyBlock. or a RSA WrappedKeyCryptogram.
" + } + }, + "WrappedKeyCryptogram": { + "base": null, + "refs": { + "ImportKeyCryptogram$WrappedKeyCryptogram": "The RSA wrapped key cryptogram under import.
" } }, "WrappedKeyMaterialFormat": { @@ -674,6 +697,13 @@ "refs": { "WrappedKey$WrappedKeyMaterialFormat": "The key block format of a wrapped key.
" } + }, + "WrappingKeySpec": { + "base": null, + "refs": { + "ExportKeyCryptogram$WrappingSpec": "The wrapping spec for the key under export.
", + "ImportKeyCryptogram$WrappingSpec": "The wrapping spec for the wrapped key cryptogram.
" + } } } } diff --git a/models/apis/personalize-runtime/2018-05-22/docs-2.json b/models/apis/personalize-runtime/2018-05-22/docs-2.json index 3e2ee50730a..34e8b6bda72 100644 --- a/models/apis/personalize-runtime/2018-05-22/docs-2.json +++ b/models/apis/personalize-runtime/2018-05-22/docs-2.json @@ -169,8 +169,8 @@ "MetadataColumns": { "base": null, "refs": { - "GetPersonalizedRankingRequest$metadataColumns": "If you enabled metadata in recommendations when you created or updated the campaign, specify metadata columns from your Items dataset to include in the personalized ranking. The map key is ITEMS and the value is a list of column names from your Items dataset. The maximum number of columns you can provide is 10.
For information about enabling metadata for a campaign, see Enabling metadata in recommendations for a campaign.
", - "GetRecommendationsRequest$metadataColumns": "If you enabled metadata in recommendations when you created or updated the campaign or recommender, specify the metadata columns from your Items dataset to include in item recommendations. The map key is ITEMS and the value is a list of column names from your Items dataset. The maximum number of columns you can provide is 10.
For information about enabling metadata for a campaign, see Enabling metadata in recommendations for a campaign. For information about enabling metadata for a recommender, see Enabling metadata in recommendations for a recommender.
" + "GetPersonalizedRankingRequest$metadataColumns": "If you enabled metadata in recommendations when you created or updated the campaign, specify metadata columns from your Items dataset to include in the personalized ranking. The map key is ITEMS and the value is a list of column names from your Items dataset. The maximum number of columns you can provide is 10.
For information about enabling metadata for a campaign, see Enabling metadata in recommendations for a campaign.
", + "GetRecommendationsRequest$metadataColumns": "If you enabled metadata in recommendations when you created or updated the campaign or recommender, specify the metadata columns from your Items dataset to include in item recommendations. The map key is ITEMS and the value is a list of column names from your Items dataset. The maximum number of columns you can provide is 10.
For information about enabling metadata for a campaign, see Enabling metadata in recommendations for a campaign. For information about enabling metadata for a recommender, see Enabling metadata in recommendations for a recommender.
" } }, "Name": { diff --git a/models/apis/personalize/2018-05-22/docs-2.json b/models/apis/personalize/2018-05-22/docs-2.json index 7c192e333fc..2d084869c2e 100644 --- a/models/apis/personalize/2018-05-22/docs-2.json +++ b/models/apis/personalize/2018-05-22/docs-2.json @@ -4,7 +4,7 @@ "operations": { "CreateBatchInferenceJob": "Generates batch recommendations based on a list of items or users stored in Amazon S3 and exports the recommendations to an Amazon S3 bucket.
To generate batch recommendations, specify the ARN of a solution version and an Amazon S3 URI for the input and output data. For user personalization, popular items, and personalized ranking solutions, the batch inference job generates a list of recommended items for each user ID in the input file. For related items solutions, the job generates a list of recommended items for each item ID in the input file.
For more information, see Creating a batch inference job .
If you use the Similar-Items recipe, Amazon Personalize can add descriptive themes to batch recommendations. To generate themes, set the job's mode to THEME_GENERATION and specify the name of the field that contains item names in the input data.
For more information about generating themes, see Batch recommendations with themes from Content Generator .
You can't get batch recommendations with the Trending-Now or Next-Best-Action recipes.
", "CreateBatchSegmentJob": "Creates a batch segment job. The operation can handle up to 50 million records and the input file must be in JSON format. For more information, see Getting batch recommendations and user segments.
", - "CreateCampaign": "Creates a campaign that deploys a solution version. When a client calls the GetRecommendations and GetPersonalizedRanking APIs, a campaign is specified in the request.
Minimum Provisioned TPS and Auto-Scaling
A high minProvisionedTPS will increase your bill. We recommend starting with 1 for minProvisionedTPS (the default). Track your usage using Amazon CloudWatch metrics, and increase the minProvisionedTPS as necessary.
A transaction is a single GetRecommendations or GetPersonalizedRanking call. Transactions per second (TPS) is the throughput and unit of billing for Amazon Personalize. The minimum provisioned TPS (minProvisionedTPS) specifies the baseline throughput provisioned by Amazon Personalize, and thus, the minimum billing charge.
If your TPS increases beyond minProvisionedTPS, Amazon Personalize auto-scales the provisioned capacity up and down, but never below minProvisionedTPS. There's a short time delay while the capacity is increased that might cause loss of transactions.
The actual TPS used is calculated as the average requests/second within a 5-minute window. You pay for maximum of either the minimum provisioned TPS or the actual TPS. We recommend starting with a low minProvisionedTPS, track your usage using Amazon CloudWatch metrics, and then increase the minProvisionedTPS as necessary.
Status
A campaign can be in one of the following states:
CREATE PENDING > CREATE IN_PROGRESS > ACTIVE -or- CREATE FAILED
DELETE PENDING > DELETE IN_PROGRESS
To get the campaign status, call DescribeCampaign.
Wait until the status of the campaign is ACTIVE before asking the campaign for recommendations.
Related APIs
", + "CreateCampaign": "Creates a campaign that deploys a solution version. When a client calls the GetRecommendations and GetPersonalizedRanking APIs, a campaign is specified in the request.
Minimum Provisioned TPS and Auto-Scaling
A high minProvisionedTPS will increase your cost. We recommend starting with 1 for minProvisionedTPS (the default). Track your usage using Amazon CloudWatch metrics, and increase the minProvisionedTPS as necessary.
When you create an Amazon Personalize campaign, you can specify the minimum provisioned transactions per second (minProvisionedTPS) for the campaign. This is the baseline transaction throughput for the campaign provisioned by Amazon Personalize. It sets the minimum billing charge for the campaign while it is active. A transaction is a single GetRecommendations or GetPersonalizedRanking request. The default minProvisionedTPS is 1.
If your TPS increases beyond the minProvisionedTPS, Amazon Personalize auto-scales the provisioned capacity up and down, but never below minProvisionedTPS. There's a short time delay while the capacity is increased that might cause loss of transactions. When your traffic reduces, capacity returns to the minProvisionedTPS.
You are charged for the the minimum provisioned TPS or, if your requests exceed the minProvisionedTPS, the actual TPS. The actual TPS is the total number of recommendation requests you make. We recommend starting with a low minProvisionedTPS, track your usage using Amazon CloudWatch metrics, and then increase the minProvisionedTPS as necessary.
For more information about campaign costs, see Amazon Personalize pricing.
Status
A campaign can be in one of the following states:
CREATE PENDING > CREATE IN_PROGRESS > ACTIVE -or- CREATE FAILED
DELETE PENDING > DELETE IN_PROGRESS
To get the campaign status, call DescribeCampaign.
Wait until the status of the campaign is ACTIVE before asking the campaign for recommendations.
Related APIs
", "CreateDataset": "Creates an empty dataset and adds it to the specified dataset group. Use CreateDatasetImportJob to import your training data to a dataset.
There are 5 types of datasets:
Item interactions
Items
Users
Action interactions
Actions
Each dataset type has an associated schema with required field types. Only the Item interactions dataset is required in order to train a model (also referred to as creating a solution).
A dataset can be in one of the following states:
CREATE PENDING > CREATE IN_PROGRESS > ACTIVE -or- CREATE FAILED
DELETE PENDING > DELETE IN_PROGRESS
To get the status of the dataset, call DescribeDataset.
Related APIs
", "CreateDatasetExportJob": " Creates a job that exports data from your dataset to an Amazon S3 bucket. To allow Amazon Personalize to export the training data, you must specify an service-linked IAM role that gives Amazon Personalize PutObject permissions for your Amazon S3 bucket. For information, see Exporting a dataset in the Amazon Personalize developer guide.
Status
A dataset export job can be in one of the following states:
CREATE PENDING > CREATE IN_PROGRESS > ACTIVE -or- CREATE FAILED
To get the status of the export job, call DescribeDatasetExportJob, and specify the Amazon Resource Name (ARN) of the dataset export job. The dataset export is complete when the status shows as ACTIVE. If the status shows as CREATE FAILED, the response includes a failureReason key, which describes why the job failed.
Creates an empty dataset group. A dataset group is a container for Amazon Personalize resources. A dataset group can contain at most three datasets, one for each type of dataset:
Item interactions
Items
Users
Actions
Action interactions
A dataset group can be a Domain dataset group, where you specify a domain and use pre-configured resources like recommenders, or a Custom dataset group, where you use custom resources, such as a solution with a solution version, that you deploy with a campaign. If you start with a Domain dataset group, you can still add custom resources such as solutions and solution versions trained with recipes for custom use cases and deployed with campaigns.
A dataset group can be in one of the following states:
CREATE PENDING > CREATE IN_PROGRESS > ACTIVE -or- CREATE FAILED
DELETE PENDING
To get the status of the dataset group, call DescribeDatasetGroup. If the status shows as CREATE FAILED, the response includes a failureReason key, which describes why the creation failed.
You must wait until the status of the dataset group is ACTIVE before adding a dataset to the group.
You can specify an Key Management Service (KMS) key to encrypt the datasets in the group. If you specify a KMS key, you must also include an Identity and Access Management (IAM) role that has permission to access the key.
APIs that require a dataset group ARN in the request
Related APIs
", @@ -136,7 +136,7 @@ "CreateRecommenderRequest$recipeArn": "The Amazon Resource Name (ARN) of the recipe that the recommender will use. For a recommender, a recipe is a Domain dataset group use case. Only Domain dataset group use cases can be used to create a recommender. For information about use cases see Choosing recommender use cases.
", "CreateRecommenderResponse$recommenderArn": "The Amazon Resource Name (ARN) of the recommender.
", "CreateSchemaResponse$schemaArn": "The Amazon Resource Name (ARN) of the created schema.
", - "CreateSolutionRequest$recipeArn": "The ARN of the recipe to use for model training. This is required when performAutoML is false.
The Amazon Resource Name (ARN) of the recipe to use for model training. This is required when performAutoML is false. For information about different Amazon Personalize recipes and their ARNs, see Choosing a recipe.
The Amazon Resource Name (ARN) of the dataset group that provides the training data.
", "CreateSolutionResponse$solutionArn": "The ARN of the solution.
", "CreateSolutionVersionRequest$solutionArn": "The Amazon Resource Name (ARN) of the solution containing the training configuration information.
", @@ -357,11 +357,11 @@ "Boolean": { "base": null, "refs": { - "CampaignConfig$enableMetadataWithRecommendations": "Whether metadata with recommendations is enabled for the campaign. If enabled, you can specify the columns from your Items dataset in your request for recommendations. Amazon Personalize returns this data for each item in the recommendation response.
If you enable metadata in recommendations, you will incur additional costs. For more information, see Amazon Personalize pricing.
", + "CampaignConfig$enableMetadataWithRecommendations": "Whether metadata with recommendations is enabled for the campaign. If enabled, you can specify the columns from your Items dataset in your request for recommendations. Amazon Personalize returns this data for each item in the recommendation response. For information about enabling metadata for a campaign, see Enabling metadata in recommendations for a campaign.
If you enable metadata in recommendations, you will incur additional costs. For more information, see Amazon Personalize pricing.
", "CreateDatasetImportJobRequest$publishAttributionMetricsToS3": "If you created a metric attribution, specify whether to publish metrics for this import job to Amazon S3
", "CreateSolutionRequest$performHPO": "Whether to perform hyperparameter optimization (HPO) on the specified or selected recipe. The default is false.
When performing AutoML, this parameter is always true and you should not set it to false.
Whether the job publishes metrics to Amazon S3 for a metric attribution.
", - "RecommenderConfig$enableMetadataWithRecommendations": "Whether metadata with recommendations is enabled for the recommender. If enabled, you can specify the columns from your Items dataset in your request for recommendations. Amazon Personalize returns this data for each item in the recommendation response.
If you enable metadata in recommendations, you will incur additional costs. For more information, see Amazon Personalize pricing.
" + "RecommenderConfig$enableMetadataWithRecommendations": "Whether metadata with recommendations is enabled for the recommender. If enabled, you can specify the columns from your Items dataset in your request for recommendations. Amazon Personalize returns this data for each item in the recommendation response. For information about enabling metadata for a recommender, see Enabling metadata in recommendations for a recommender.
If you enable metadata in recommendations, you will incur additional costs. For more information, see Amazon Personalize pricing.
" } }, "Campaign": { @@ -1736,7 +1736,7 @@ "PerformAutoML": { "base": null, "refs": { - "CreateSolutionRequest$performAutoML": "We don't recommend enabling automated machine learning. Instead, match your use case to the available Amazon Personalize recipes. For more information, see Determining your use case.
Whether to perform automated machine learning (AutoML). The default is false. For this case, you must specify recipeArn.
When set to true, Amazon Personalize analyzes your training data and selects the optimal USER_PERSONALIZATION recipe and hyperparameters. In this case, you must omit recipeArn. Amazon Personalize determines the optimal recipe by running tests with different values for the hyperparameters. AutoML lengthens the training process as compared to selecting a specific recipe.
We don't recommend enabling automated machine learning. Instead, match your use case to the available Amazon Personalize recipes. For more information, see Choosing a recipe.
Whether to perform automated machine learning (AutoML). The default is false. For this case, you must specify recipeArn.
When set to true, Amazon Personalize analyzes your training data and selects the optimal USER_PERSONALIZATION recipe and hyperparameters. In this case, you must omit recipeArn. Amazon Personalize determines the optimal recipe by running tests with different values for the hyperparameters. AutoML lengthens the training process as compared to selecting a specific recipe.
We don't recommend enabling automated machine learning. Instead, match your use case to the available Amazon Personalize recipes. For more information, see Determining your use case.
When true, Amazon Personalize performs a search for the best USER_PERSONALIZATION recipe from the list specified in the solution configuration (recipeArn must not be specified). When false (the default), Amazon Personalize uses recipeArn for training.
When true, Amazon Personalize searches for the most optimal recipe according to the solution configuration. When false (the default), Amazon Personalize uses recipeArn.
This is the API Reference for Amazon Rekognition Image, Amazon Rekognition Custom Labels, Amazon Rekognition Stored Video, Amazon Rekognition Streaming Video. It provides descriptions of actions, data types, common parameters, and common errors.
Amazon Rekognition Image
Amazon Rekognition Custom Labels
Amazon Rekognition Video Stored Video
Amazon Rekognition Video Streaming Video
This is the API Reference for Amazon Rekognition Image, Amazon Rekognition Custom Labels, Amazon Rekognition Stored Video, Amazon Rekognition Streaming Video. It provides descriptions of actions, data types, common parameters, and common errors.
Amazon Rekognition Image
Amazon Rekognition Custom Labels
Amazon Rekognition Video Stored Video
Amazon Rekognition Video Streaming Video
Associates one or more faces with an existing UserID. Takes an array of FaceIds. Each FaceId that are present in the FaceIds list is associated with the provided UserID. The maximum number of total FaceIds per UserID is 100.
The UserMatchThreshold parameter specifies the minimum user match confidence required for the face to be associated with a UserID that has at least one FaceID already associated. This ensures that the FaceIds are associated with the right UserID. The value ranges from 0-100 and default value is 75.
If successful, an array of AssociatedFace objects containing the associated FaceIds is returned. If a given face is already associated with the given UserID, it will be ignored and will not be returned in the response. If a given face is already associated to a different UserID, isn't found in the collection, doesn’t meet the UserMatchThreshold, or there are already 100 faces associated with the UserID, it will be returned as part of an array of UnsuccessfulFaceAssociations.
The UserStatus reflects the status of an operation which updates a UserID representation with a list of given faces. The UserStatus can be:
ACTIVE - All associations or disassociations of FaceID(s) for a UserID are complete.
CREATED - A UserID has been created, but has no FaceID(s) associated with it.
UPDATING - A UserID is being updated and there are current associations or disassociations of FaceID(s) taking place.
Compares a face in the source input image with each of the 100 largest faces detected in the target input image.
If the source image contains multiple faces, the service detects the largest face and compares it with each face detected in the target image.
CompareFaces uses machine learning algorithms, which are probabilistic. A false negative is an incorrect prediction that a face in the target image has a low similarity confidence score when compared to the face in the source image. To reduce the probability of false negatives, we recommend that you compare the target image against multiple source images. If you plan to use CompareFaces to make a decision that impacts an individual's rights, privacy, or access to services, we recommend that you pass the result to a human for review and further validation before taking action.
You pass the input and target images either as base64-encoded image bytes or as references to images in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes isn't supported. The image must be formatted as a PNG or JPEG file.
In response, the operation returns an array of face matches ordered by similarity score in descending order. For each face match, the response provides a bounding box of the face, facial landmarks, pose details (pitch, roll, and yaw), quality (brightness and sharpness), and confidence value (indicating the level of confidence that the bounding box contains a face). The response also provides a similarity score, which indicates how closely the faces match.
By default, only faces with a similarity score of greater than or equal to 80% are returned in the response. You can change this value by specifying the SimilarityThreshold parameter.
CompareFaces also returns an array of faces that don't match the source image. For each face, it returns a bounding box, confidence value, landmarks, pose details, and quality. The response also returns information about the face in the source image, including the bounding box of the face and confidence value.
The QualityFilter input parameter allows you to filter out detected faces that don’t meet a required quality bar. The quality bar is based on a variety of common use cases. Use QualityFilter to set the quality bar by specifying LOW, MEDIUM, or HIGH. If you do not want to filter detected faces, specify NONE. The default value is NONE.
If the image doesn't contain Exif metadata, CompareFaces returns orientation information for the source and target images. Use these values to display the images with the correct image orientation.
If no faces are detected in the source or target images, CompareFaces returns an InvalidParameterException error.
This is a stateless API operation. That is, data returned by this operation doesn't persist.
For an example, see Comparing Faces in Images in the Amazon Rekognition Developer Guide.
This operation requires permissions to perform the rekognition:CompareFaces action.
Lists and describes the versions of an Amazon Rekognition project. You can specify up to 10 model or adapter versions in ProjectVersionArns. If you don't specify a value, descriptions for all model/adapter versions in the project are returned.
This operation requires permissions to perform the rekognition:DescribeProjectVersions action.
Gets information about your Rekognition projects.
This operation requires permissions to perform the rekognition:DescribeProjects action.
Provides information about a stream processor created by CreateStreamProcessor. You can get information about the input and output streams, the input parameters for the face recognition being performed, and the current status of the stream processor.
", - "DetectCustomLabels": "This operation applies only to Amazon Rekognition Custom Labels.
Detects custom labels in a supplied image by using an Amazon Rekognition Custom Labels model.
You specify which version of a model version to use by using the ProjectVersionArn input parameter.
You pass the input image as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file.
For each object that the model version detects on an image, the API returns a (CustomLabel) object in an array (CustomLabels). Each CustomLabel object provides the label name (Name), the level of confidence that the image contains the object (Confidence), and object location information, if it exists, for the label on the image (Geometry).
To filter labels that are returned, specify a value for MinConfidence. DetectCustomLabelsLabels only returns labels with a confidence that's higher than the specified value. The value of MinConfidence maps to the assumed threshold values created during training. For more information, see Assumed threshold in the Amazon Rekognition Custom Labels Developer Guide. Amazon Rekognition Custom Labels metrics expresses an assumed threshold as a floating point value between 0-1. The range of MinConfidence normalizes the threshold value to a percentage value (0-100). Confidence responses from DetectCustomLabels are also returned as a percentage. You can use MinConfidence to change the precision and recall or your model. For more information, see Analyzing an image in the Amazon Rekognition Custom Labels Developer Guide.
If you don't specify a value for MinConfidence, DetectCustomLabels returns labels based on the assumed threshold of each label.
This is a stateless API operation. That is, the operation does not persist any data.
This operation requires permissions to perform the rekognition:DetectCustomLabels action.
For more information, see Analyzing an image in the Amazon Rekognition Custom Labels Developer Guide.
", + "DetectCustomLabels": "This operation applies only to Amazon Rekognition Custom Labels.
Detects custom labels in a supplied image by using an Amazon Rekognition Custom Labels model.
You specify which version of a model version to use by using the ProjectVersionArn input parameter.
You pass the input image as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file.
For each object that the model version detects on an image, the API returns a (CustomLabel) object in an array (CustomLabels). Each CustomLabel object provides the label name (Name), the level of confidence that the image contains the object (Confidence), and object location information, if it exists, for the label on the image (Geometry). Note that for the DetectCustomLabelsLabels operation, Polygons are not returned in the Geometry section of the response.
To filter labels that are returned, specify a value for MinConfidence. DetectCustomLabelsLabels only returns labels with a confidence that's higher than the specified value. The value of MinConfidence maps to the assumed threshold values created during training. For more information, see Assumed threshold in the Amazon Rekognition Custom Labels Developer Guide. Amazon Rekognition Custom Labels metrics expresses an assumed threshold as a floating point value between 0-1. The range of MinConfidence normalizes the threshold value to a percentage value (0-100). Confidence responses from DetectCustomLabels are also returned as a percentage. You can use MinConfidence to change the precision and recall or your model. For more information, see Analyzing an image in the Amazon Rekognition Custom Labels Developer Guide.
If you don't specify a value for MinConfidence, DetectCustomLabels returns labels based on the assumed threshold of each label.
This is a stateless API operation. That is, the operation does not persist any data.
This operation requires permissions to perform the rekognition:DetectCustomLabels action.
For more information, see Analyzing an image in the Amazon Rekognition Custom Labels Developer Guide.
", "DetectFaces": "Detects faces within an image that is provided as input.
DetectFaces detects the 100 largest faces in the image. For each face detected, the operation returns face details. These details include a bounding box of the face, a confidence value (that the bounding box contains a face), and a fixed set of attributes such as facial landmarks (for example, coordinates of eye and mouth), pose, presence of facial occlusion, and so on.
The face-detection algorithm is most effective on frontal faces. For non-frontal or obscured faces, the algorithm might not detect the faces or might detect faces with lower confidence.
You pass the input image either as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file.
This is a stateless API operation. That is, the operation does not persist any data.
This operation requires permissions to perform the rekognition:DetectFaces action.
Detects instances of real-world entities within an image (JPEG or PNG) provided as input. This includes objects like flower, tree, and table; events like wedding, graduation, and birthday party; and concepts like landscape, evening, and nature.
For an example, see Analyzing images stored in an Amazon S3 bucket in the Amazon Rekognition Developer Guide.
You pass the input image as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file.
Optional Parameters
You can specify one or both of the GENERAL_LABELS and IMAGE_PROPERTIES feature types when calling the DetectLabels API. Including GENERAL_LABELS will ensure the response includes the labels detected in the input image, while including IMAGE_PROPERTIES will ensure the response includes information about the image quality and color.
When using GENERAL_LABELS and/or IMAGE_PROPERTIES you can provide filtering criteria to the Settings parameter. You can filter with sets of individual labels or with label categories. You can specify inclusive filters, exclusive filters, or a combination of inclusive and exclusive filters. For more information on filtering see Detecting Labels in an Image.
When getting labels, you can specify MinConfidence to control the confidence threshold for the labels returned. The default is 55%. You can also add the MaxLabels parameter to limit the number of labels returned. The default and upper limit is 1000 labels. These arguments are only valid when supplying GENERAL_LABELS as a feature type.
Response Elements
For each object, scene, and concept the API returns one or more labels. The API returns the following types of information about labels:
Name - The name of the detected label.
Confidence - The level of confidence in the label assigned to a detected object.
Parents - The ancestor labels for a detected label. DetectLabels returns a hierarchical taxonomy of detected labels. For example, a detected car might be assigned the label car. The label car has two parent labels: Vehicle (its parent) and Transportation (its grandparent). The response includes the all ancestors for a label, where every ancestor is a unique label. In the previous example, Car, Vehicle, and Transportation are returned as unique labels in the response.
Aliases - Possible Aliases for the label.
Categories - The label categories that the detected label belongs to.
BoundingBox — Bounding boxes are described for all instances of detected common object labels, returned in an array of Instance objects. An Instance object contains a BoundingBox object, describing the location of the label on the input image. It also includes the confidence for the accuracy of the detected bounding box.
The API returns the following information regarding the image, as part of the ImageProperties structure:
Quality - Information about the Sharpness, Brightness, and Contrast of the input image, scored between 0 to 100. Image quality is returned for the entire image, as well as the background and the foreground.
Dominant Color - An array of the dominant colors in the image.
Foreground - Information about the sharpness, brightness, and dominant colors of the input image’s foreground.
Background - Information about the sharpness, brightness, and dominant colors of the input image’s background.
The list of returned labels will include at least one label for every detected object, along with information about that label. In the following example, suppose the input image has a lighthouse, the sea, and a rock. The response includes all three labels, one for each object, as well as the confidence in the label:
{Name: lighthouse, Confidence: 98.4629}
{Name: rock,Confidence: 79.2097}
{Name: sea,Confidence: 75.061}
The list of labels can include multiple labels for the same object. For example, if the input image shows a flower (for example, a tulip), the operation might return the following three labels.
{Name: flower,Confidence: 99.0562}
{Name: plant,Confidence: 99.0562}
{Name: tulip,Confidence: 99.0562}
In this example, the detection algorithm more precisely identifies the flower as a tulip.
If the object detected is a person, the operation doesn't provide the same facial details that the DetectFaces operation provides.
This is a stateless API operation that doesn't return any data.
This operation requires permissions to perform the rekognition:DetectLabels action.
Detects unsafe content in a specified JPEG or PNG format image. Use DetectModerationLabels to moderate images depending on your requirements. For example, you might want to filter images that contain nudity, but not images containing suggestive content.
To filter images, use the labels returned by DetectModerationLabels to determine which types of content are appropriate.
For information about moderation labels, see Detecting Unsafe Content in the Amazon Rekognition Developer Guide.
You pass the input image either as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file.
You can specify an adapter to use when retrieving label predictions by providing a ProjectVersionArn to the ProjectVersion argument.
An array of AssociatedFace objects containing FaceIDs that are successfully associated with the UserID is returned. Returned if the AssociateFaces action is successful.
" + "AssociateFacesResponse$AssociatedFaces": "An array of AssociatedFace objects containing FaceIDs that have been successfully associated with the UserID. Returned if the AssociateFaces action is successful.
" } }, "Attribute": { @@ -441,6 +441,18 @@ "GetContentModerationRequestMetadata$SortBy": "The sorting method chosen for a GetContentModeration request.
" } }, + "ContentType": { + "base": "Contains information regarding the confidence and name of a detected content type.
", + "refs": { + "ContentTypes$member": null + } + }, + "ContentTypes": { + "base": null, + "refs": { + "DetectModerationLabelsResponse$ContentTypes": "A list of predicted results for the type of content an image contains. For example, the image content might be from animation, sports, or a video game.
" + } + }, "CopyProjectVersionRequest": { "base": null, "refs": { @@ -2119,6 +2131,12 @@ "MediaAnalysisJobDescription$ManifestSummary": "Provides statistics on input manifest and errors identified in the input manifest.
" } }, + "MediaAnalysisModelVersions": { + "base": "Object containing information about the model versions of selected features in a given job.
", + "refs": { + "MediaAnalysisResults$ModelVersions": "Information about the model versions for the features selected in a given job.
" + } + }, "MediaAnalysisOperationsConfig": { "base": "Configuration options for a media analysis job. Configuration is operation-specific.
", "refs": { @@ -2271,6 +2289,7 @@ "ComparedSourceImageFace$Confidence": "Confidence level that the selected bounding box contains a face.
", "ConnectedHomeSettings$MinConfidence": "The minimum confidence required to label an object in the video.
", "ConnectedHomeSettingsForUpdate$MinConfidence": "The minimum confidence required to label an object in the video.
", + "ContentType$Confidence": "The confidence level of the label given
", "CoversBodyPart$Confidence": "The confidence that Amazon Rekognition has in the value of Value.
The confidence that the model has in the detection of the custom label. The range is 0-100. A higher value indicates a higher confidence.
", "CustomizationFeatureContentModerationConfig$ConfidenceThreshold": "The confidence level you plan to use to identify if unsafe content is present during inference.
", @@ -3158,6 +3177,7 @@ "AudioMetadata$Codec": "The audio codec used to encode or decode the audio stream.
", "Celebrity$Name": "The name of the celebrity.
", "CelebrityDetail$Name": "The name of the celebrity.
", + "ContentType$Name": "The name of the label
", "CreateCollectionResponse$CollectionArn": "Amazon Resource Name (ARN) of the collection. You can use this to manage permissions on your resources.
", "CreateCollectionResponse$FaceModelVersion": "Version number of the face detection model associated with the collection you are creating.
", "CustomLabel$Name": "The name of the custom label.
", @@ -3186,6 +3206,7 @@ "ListFacesResponse$NextToken": "If the response is truncated, Amazon Rekognition returns this token that you can use in the subsequent request to retrieve the next set of faces.
", "ListFacesResponse$FaceModelVersion": "Version number of the face detection model associated with the input collection (CollectionId).
Human readable error message.
", + "MediaAnalysisModelVersions$Moderation": "The Moderation base model version.
", "ModerationLabel$Name": "The label name for the type of unsafe content detected in the image.
", "ModerationLabel$ParentName": "The name for the parent label. Labels at the top level of the hierarchy have the parent label \"\".
The name of the parent label.
", @@ -3368,6 +3389,7 @@ "DominantColor$Red": "The Red RGB value for a dominant color.
", "DominantColor$Blue": "The Blue RGB value for a dominant color.
", "DominantColor$Green": "The Green RGB value for a dominant color.
", + "ModerationLabel$TaxonomyLevel": "The level of the moderation label with regard to its taxonomy, from 1 to 3.
", "ProtectiveEquipmentPerson$Id": "The identifier for the detected person. The identifier is only unique for a single call to DetectProtectiveEquipment.
The identifier for the detected text. The identifier is only unique for a single call to DetectText.
Security Hub provides you with a comprehensive view of the security state of your Amazon Web Services environment and resources. It also provides you with the readiness status of your environment based on controls from supported security standards. Security Hub collects security data from Amazon Web Services accounts, services, and integrated third-party products and helps you analyze security trends in your environment to identify the highest priority security issues. For more information about Security Hub, see the Security Hub User Guide .
When you use operations in the Security Hub API, the requests are executed only in the Amazon Web Services Region that is currently active or in the specific Amazon Web Services Region that you specify in your request. Any configuration or settings change that results from the operation is applied only to that Region. To make the same change in other Regions, run the same command for each Region in which you want to apply the change.
For example, if your Region is set to us-west-2, when you use CreateMembers to add a member account to Security Hub, the association of the member account with the administrator account is created only in the us-west-2 Region. Security Hub must be enabled for the member account in the same Region that the invitation was sent from.
The following throttling limits apply to using Security Hub API operations.
BatchEnableStandards - RateLimit of 1 request per second. BurstLimit of 1 request per second.
GetFindings - RateLimit of 3 requests per second. BurstLimit of 6 requests per second.
BatchImportFindings - RateLimit of 10 requests per second. BurstLimit of 30 requests per second.
BatchUpdateFindings - RateLimit of 10 requests per second. BurstLimit of 30 requests per second.
UpdateStandardsControl - RateLimit of 1 request per second. BurstLimit of 5 requests per second.
All other operations - RateLimit of 10 requests per second. BurstLimit of 30 requests per second.
Security Hub provides you with a comprehensive view of your security state in Amazon Web Services and helps you assess your Amazon Web Services environment against security industry standards and best practices.
Security Hub collects security data across Amazon Web Services accounts, Amazon Web Services, and supported third-party products and helps you analyze your security trends and identify the highest priority security issues.
To help you manage the security state of your organization, Security Hub supports multiple security standards. These include the Amazon Web Services Foundational Security Best Practices (FSBP) standard developed by Amazon Web Services, and external compliance frameworks such as the Center for Internet Security (CIS), the Payment Card Industry Data Security Standard (PCI DSS), and the National Institute of Standards and Technology (NIST). Each standard includes several security controls, each of which represents a security best practice. Security Hub runs checks against security controls and generates control findings to help you assess your compliance against security best practices.
In addition to generating control findings, Security Hub also receives findings from other Amazon Web Services, such as Amazon GuardDuty and Amazon Inspector, and supported third-party products. This gives you a single pane of glass into a variety of security-related issues. You can also send Security Hub findings to other Amazon Web Services and supported third-party products.
Security Hub offers automation features that help you triage and remediate security issues. For example, you can use automation rules to automatically update critical findings when a security check fails. You can also leverage the integration with Amazon EventBridge to trigger automatic responses to specific findings.
This guide, the Security Hub API Reference, provides information about the Security Hub API. This includes supported resources, HTTP methods, parameters, and schemas. If you're new to Security Hub, you might find it helpful to also review the Security Hub User Guide . The user guide explains key concepts and provides procedures that demonstrate how to use Security Hub features. It also provides information about topics such as integrating Security Hub with other Amazon Web Services.
In addition to interacting with Security Hub by making calls to the Security Hub API, you can use a current version of an Amazon Web Services command line tool or SDK. Amazon Web Services provides tools and SDKs that consist of libraries and sample code for various languages and platforms, such as PowerShell, Java, Go, Python, C++, and .NET. These tools and SDKs provide convenient, programmatic access to Security Hub and other Amazon Web Services . They also handle tasks such as signing requests, managing errors, and retrying requests automatically. For information about installing and using the Amazon Web Services tools and SDKs, see Tools to Build on Amazon Web Services.
With the exception of operations that are related to central configuration, Security Hub API requests are executed only in the Amazon Web Services Region that is currently active or in the specific Amazon Web Services Region that you specify in your request. Any configuration or settings change that results from the operation is applied only to that Region. To make the same change in other Regions, call the same API operation in each Region in which you want to apply the change. When you use central configuration, API requests for enabling Security Hub, standards, and controls are executed in the home Region and all linked Regions. For a list of central configuration operations, see the Central configuration terms and concepts section of the Security Hub User Guide.
The following throttling limits apply to Security Hub API operations.
BatchEnableStandards - RateLimit of 1 request per second. BurstLimit of 1 request per second.
GetFindings - RateLimit of 3 requests per second. BurstLimit of 6 requests per second.
BatchImportFindings - RateLimit of 10 requests per second. BurstLimit of 30 requests per second.
BatchUpdateFindings - RateLimit of 10 requests per second. BurstLimit of 30 requests per second.
UpdateStandardsControl - RateLimit of 1 request per second. BurstLimit of 5 requests per second.
All other operations - RateLimit of 10 requests per second. BurstLimit of 30 requests per second.
Accepts the invitation to be a member account and be monitored by the Security Hub administrator account that the invitation was sent from.
This operation is only used by member accounts that are not added through Organizations.
When the member account accepts the invitation, permission is granted to the administrator account to view findings generated in the member account.
", "AcceptInvitation": "This method is deprecated. Instead, use AcceptAdministratorInvitation.
The Security Hub console continues to use AcceptInvitation. It will eventually change to use AcceptAdministratorInvitation. Any IAM policies that specifically control access to this function must continue to use AcceptInvitation. You should also add AcceptAdministratorInvitation to your policies to ensure that the correct permissions are in place after the console begins to use AcceptAdministratorInvitation.
Accepts the invitation to be a member account and be monitored by the Security Hub administrator account that the invitation was sent from.
This operation is only used by member accounts that are not added through Organizations.
When the member account accepts the invitation, permission is granted to the administrator account to view findings generated in the member account.
", @@ -8089,7 +8089,7 @@ "AwsLambdaFunctionDetails$Architectures": "The instruction set architecture that the function uses. Valid values are x86_64 or arm64.
A list of VPC security groups IDs.
", "AwsLambdaFunctionVpcConfig$SubnetIds": "A list of VPC subnet IDs.
", - "AwsLambdaLayerVersionDetails$CompatibleRuntimes": "The layer's compatible runtimes. Maximum number of five items.
Valid values: nodejs10.x | nodejs12.x | java8 | java11 | python2.7 | python3.6 | python3.7 | python3.8 | dotnetcore1.0 | dotnetcore2.1 | go1.x | ruby2.5 | provided
The layer's compatible function runtimes.
The following list includes deprecated runtimes. For more information, see Runtime deprecation policy in the Lambda Developer Guide.
Array Members: Maximum number of 5 items.
Valid Values: nodejs | nodejs4.3 | nodejs6.10 | nodejs8.10 | nodejs10.x | nodejs12.x | nodejs14.x | nodejs16.x | java8 | java8.al2 | java11 | python2.7 | python3.6 | python3.7 | python3.8 | python3.9 | dotnetcore1.0 | dotnetcore2.0 | dotnetcore2.1 | dotnetcore3.1 | dotnet6 | nodejs4.3-edge | go1.x | ruby2.5 | ruby2.7 | provided | provided.al2 | nodejs18.x | python3.10 | java17 | ruby3.2 | python3.11 | nodejs20.x | provided.al2023 | python3.12 | java21
The list of security group IDs that are associated with the VPC endpoints for the domain.
", "AwsOpenSearchServiceDomainVpcOptionsDetails$SubnetIds": "A list of subnet IDs that are associated with the VPC endpoints for the domain.
", "AwsRdsDbClusterSnapshotDbClusterSnapshotAttribute$AttributeValues": " The value(s) for the manual DB cluster snapshot attribute. If the AttributeName field is set to restore, then this element returns a list of IDs of the Amazon Web Services accounts that are authorized to copy or restore the manual DB cluster snapshot. If a value of all is in the list, then the manual DB cluster snapshot is public and available for any Amazon Web Services account to copy or restore.