import type { MetadataBearer as __MetadataBearer } from "@smithy/types"; import type { GetKeyRotationStatusRequest, GetKeyRotationStatusResponse } from "../models/models_0"; /** * @public */ export type { __MetadataBearer }; /** * @public * * The input for {@link GetKeyRotationStatusCommand}. */ export interface GetKeyRotationStatusCommandInput extends GetKeyRotationStatusRequest { } /** * @public * * The output of {@link GetKeyRotationStatusCommand}. */ export interface GetKeyRotationStatusCommandOutput extends GetKeyRotationStatusResponse, __MetadataBearer { } declare const GetKeyRotationStatusCommand_base: { new (input: GetKeyRotationStatusCommandInput): import("@smithy/core/client").CommandImpl; new (input: GetKeyRotationStatusCommandInput): import("@smithy/core/client").CommandImpl; getEndpointParameterInstructions(): import("@smithy/types").EndpointParameterInstructions; }; /** *

Provides detailed information about the rotation status for a KMS key, including whether * automatic * rotation of the key material is enabled for the specified KMS key, the rotation * period, and the next scheduled rotation date.

*

Automatic key rotation is supported only on symmetric encryption KMS keys. * You cannot enable automatic rotation of asymmetric KMS keys, HMAC KMS keys, KMS keys with imported key material, or KMS keys in a custom key store. To enable or disable automatic rotation of a set of related multi-Region keys, set the property on the primary key.

*

You can enable (EnableKeyRotation) and disable automatic rotation (DisableKeyRotation) of the key material in customer managed KMS keys. Key * material rotation of Amazon Web Services managed KMS keys is not * configurable. KMS always rotates the key material in Amazon Web Services managed KMS keys every year. The * key rotation status for Amazon Web Services managed KMS keys is always true.

*

You can perform on-demand (RotateKeyOnDemand) rotation of the key * material in customer managed KMS keys, regardless of whether or not automatic key rotation is * enabled. You can use GetKeyRotationStatus to identify the date and time that an in progress * on-demand rotation was initiated. You can use ListKeyRotations to view the * details of completed rotations.

* *

In May 2022, KMS changed the rotation schedule for Amazon Web Services managed keys from every three * years to every year. For details, see EnableKeyRotation.

*
*

The KMS key that you use for this operation must be in a compatible key state. For * details, see Key states of KMS keys in the Key Management Service Developer Guide.

* *

* Cross-account use: Yes. To perform this operation on a KMS key in a different Amazon Web Services account, specify the key * ARN in the value of the KeyId parameter.

*

* Required permissions: kms:GetKeyRotationStatus (key policy)

*

* Related operations: *

* *

* Eventual consistency: The KMS API follows an eventual consistency model. * For more information, see KMS eventual consistency.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript * import { KMSClient, GetKeyRotationStatusCommand } from "@aws-sdk/client-kms"; // ES Modules import * // const { KMSClient, GetKeyRotationStatusCommand } = require("@aws-sdk/client-kms"); // CommonJS import * // import type { KMSClientConfig } from "@aws-sdk/client-kms"; * const config = {}; // type is KMSClientConfig * const client = new KMSClient(config); * const input = { // GetKeyRotationStatusRequest * KeyId: "STRING_VALUE", // required * }; * const command = new GetKeyRotationStatusCommand(input); * const response = await client.send(command); * // { // GetKeyRotationStatusResponse * // KeyRotationEnabled: true || false, * // KeyId: "STRING_VALUE", * // RotationPeriodInDays: Number("int"), * // NextRotationDate: new Date("TIMESTAMP"), * // OnDemandRotationStartDate: new Date("TIMESTAMP"), * // }; * * ``` * * @param GetKeyRotationStatusCommandInput - {@link GetKeyRotationStatusCommandInput} * @returns {@link GetKeyRotationStatusCommandOutput} * @see {@link GetKeyRotationStatusCommandInput} for command's `input` shape. * @see {@link GetKeyRotationStatusCommandOutput} for command's `response` shape. * @see {@link KMSClientResolvedConfig | config} for KMSClient's `config` shape. * * @throws {@link DependencyTimeoutException} (server fault) *

The system timed out while trying to fulfill the request. You can retry the * request.

* * @throws {@link InvalidArnException} (client fault) *

The request was rejected because a specified ARN, or an ARN in a key policy, is not * valid.

* * @throws {@link KMSInternalException} (server fault) *

The request was rejected because an internal exception occurred. The request can be * retried.

* * @throws {@link KMSInvalidStateException} (client fault) *

The request was rejected because the state of the specified resource is not valid for this * request.

*

This exceptions means one of the following:

* * * @throws {@link NotFoundException} (client fault) *

The request was rejected because the specified entity or resource could not be * found.

* * @throws {@link UnsupportedOperationException} (client fault) *

The request was rejected because a specified parameter is not supported or a specified * resource is not valid for this operation.

* * @throws {@link KMSServiceException} *

Base exception class for all service exceptions from KMS service.

* * * @public */ export declare class GetKeyRotationStatusCommand extends GetKeyRotationStatusCommand_base { /** @internal type navigation helper, not in runtime. */ protected static __types: { api: { input: GetKeyRotationStatusRequest; output: GetKeyRotationStatusResponse; }; sdk: { input: GetKeyRotationStatusCommandInput; output: GetKeyRotationStatusCommandOutput; }; }; }