@@ -28,18 +28,27 @@ final class CreateKeyRequest extends Input
2828 * KMS. For more information, see Changes that I make are not always immediately visible [^2] in the *Amazon Web
2929 * Services Identity and Access Management User Guide*.
3030 *
31+ * > If either of the required `Resource` or `Action` elements are missing from a key policy statement, the policy
32+ * > statement has no effect. When a key policy statement is missing one of these elements, the KMS console correctly
33+ * > reports an error, but the `CreateKey` and `PutKeyPolicy` API requests succeed, even though the policy statement is
34+ * > ineffective.
35+ * >
36+ * > For more information on required key policy elements, see Elements in a key policy [^3] in the *Key Management
37+ * > Service Developer Guide*.
38+ *
3139 * If you do not provide a key policy, KMS attaches a default key policy to the KMS key. For more information, see
32- * Default key policy [^3 ] in the *Key Management Service Developer Guide*.
40+ * Default key policy [^4 ] in the *Key Management Service Developer Guide*.
3341 *
34- * The key policy size quota is 32 kilobytes (32768 bytes) .
42+ * > If the key policy exceeds the length constraint, KMS returns a `LimitExceededException` .
3543 *
36- * For help writing and formatting a JSON policy document, see the IAM JSON Policy Reference [^4 ] in the **Identity and
44+ * For help writing and formatting a JSON policy document, see the IAM JSON Policy Reference [^5 ] in the **Identity and
3745 * Access Management User Guide**.
3846 *
3947 * [^1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#prevent-unmanageable-key
4048 * [^2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency
41- * [^3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default
42- * [^4]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
49+ * [^3]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements
50+ * [^4]: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html
51+ * [^5]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html
4352 *
4453 * @var string|null
4554 */
@@ -73,7 +82,7 @@ final class CreateKeyRequest extends Input
7382 * - For asymmetric KMS keys with SM2 key pairs (China Regions only), specify `ENCRYPT_DECRYPT`, `SIGN_VERIFY`, or
7483 * `KEY_AGREEMENT`.
7584 *
76- * [^1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts .html#cryptographic-operations
85+ * [^1]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography .html#cryptographic-operations
7786 *
7887 * @var KeyUsageType::*|null
7988 */
@@ -92,16 +101,16 @@ final class CreateKeyRequest extends Input
92101 /**
93102 * Specifies the type of KMS key to create. The default value, `SYMMETRIC_DEFAULT`, creates a KMS key with a 256-bit
94103 * AES-GCM key that is used for encryption and decryption, except in China Regions, where it creates a 128-bit symmetric
95- * key that uses SM4 encryption. For help choosing a key spec for your KMS key, see Choosing a KMS key type [^1] in the
96- * **Key Management Service Developer Guide**.
104+ * key that uses SM4 encryption. For a detailed description of all supported key specs , see Key spec reference [^1] in
105+ * the **Key Management Service Developer Guide**.
97106 *
98107 * The `KeySpec` determines whether the KMS key contains a symmetric key or an asymmetric key pair. It also determines
99108 * the algorithms that the KMS key supports. You can't change the `KeySpec` after the KMS key is created. To further
100109 * restrict the algorithms that can be used with the KMS key, use a condition key in its key policy or IAM policy. For
101- * more information, see kms:EncryptionAlgorithm [^2], kms:MacAlgorithm [^3] or kms:Signing Algorithm [^4] in the **Key
102- * Management Service Developer Guide**.
110+ * more information, see kms:EncryptionAlgorithm [^2], kms:MacAlgorithm [^3], kms:KeyAgreementAlgorithm [^4], or
111+ * kms:SigningAlgorithm [^5] in the **Key Management Service Developer Guide**.
103112 *
104- * ! Amazon Web Services services that are integrated with KMS [^5 ] use symmetric encryption KMS keys to protect your
113+ * ! Amazon Web Services services that are integrated with KMS [^6 ] use symmetric encryption KMS keys to protect your
105114 * ! data. These services do not support asymmetric KMS keys or HMAC KMS keys.
106115 *
107116 * KMS supports the following key specs for KMS keys:
@@ -137,11 +146,12 @@ final class CreateKeyRequest extends Input
137146 *
138147 * - `SM2` (China Regions only)
139148 *
140- * [^1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-types.html#symm-asymm-choose
141- * [^2]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-encryption-algorithm
142- * [^3]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-mac-algorithm
143- * [^4]: https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-signing-algorithm
144- * [^5]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
149+ * [^1]: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html
150+ * [^2]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm
151+ * [^3]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm
152+ * [^4]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-agreement-algorithm
153+ * [^5]: https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm
154+ * [^6]: http://aws.amazon.com/kms/features/#AWS_Service_Integration
145155 *
146156 * @var KeySpec::*|null
147157 */
@@ -183,7 +193,7 @@ final class CreateKeyRequest extends Input
183193 * associated CloudHSM cluster and associates it with the KMS key. When you create a KMS key in an external key store,
184194 * you must use the `XksKeyId` parameter to specify an external key that serves as key material for the KMS key.
185195 *
186- * [^1]: https://docs.aws.amazon.com/kms/latest/developerguide/custom- key-store-overview.html
196+ * [^1]: https://docs.aws.amazon.com/kms/latest/developerguide/key-store-overview.html
187197 *
188198 * @var string|null
189199 */
@@ -224,8 +234,8 @@ final class CreateKeyRequest extends Input
224234 * an existing tag key with a different tag value, KMS replaces the current tag value with the specified one.
225235 *
226236 * When you add tags to an Amazon Web Services resource, Amazon Web Services generates a cost allocation report with
227- * usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see Tagging
228- * Keys [^3].
237+ * usage and costs aggregated by tags. Tags can also be used to control access to a KMS key. For details, see Tags in
238+ * KMS [^3].
229239 *
230240 * [^1]: https://docs.aws.amazon.com/kms/latest/developerguide/abac.html
231241 * [^2]: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html
@@ -282,7 +292,7 @@ final class CreateKeyRequest extends Input
282292 * [^1]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-external-key
283293 * [^2]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html
284294 * [^3]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-xks-proxy
285- * [^4]: https://docs.aws.amazon.com/create-xks-keys.html#xks-key-requirements
295+ * [^4]: https://docs.aws.amazon.com/kms/latest/developerguide/ create-xks-keys.html#xks-key-requirements
286296 * [^5]: https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html#concept-double-encryption
287297 *
288298 * @var string|null
0 commit comments