import type { MetadataBearer as __MetadataBearer } from "@smithy/types"; import type { UpdateAliasRequest } from "../models/models_0"; /** * @public */ export type { __MetadataBearer }; /** * @public * * The input for {@link UpdateAliasCommand}. */ export interface UpdateAliasCommandInput extends UpdateAliasRequest { } /** * @public * * The output of {@link UpdateAliasCommand}. */ export interface UpdateAliasCommandOutput extends __MetadataBearer { } declare const UpdateAliasCommand_base: { new (input: UpdateAliasCommandInput): import("@smithy/core/client").CommandImpl; new (input: UpdateAliasCommandInput): import("@smithy/core/client").CommandImpl; getEndpointParameterInstructions(): import("@smithy/types").EndpointParameterInstructions; }; /** *

Associates an existing KMS alias with a different KMS key. Each alias is associated with * only one KMS key at a time, although a KMS key can have multiple aliases. The alias and the * KMS key must be in the same Amazon Web Services account and Region.

* *

Adding, deleting, or updating an alias can allow or deny permission to the KMS key. For details, see ABAC for KMS in the Key Management Service Developer Guide.

* *

The current and new KMS key must be the same type (both symmetric or both asymmetric or * both HMAC), and they must have the same key usage. This restriction prevents errors in code * that uses aliases. If you must assign an alias to a different type of KMS key, use DeleteAlias to delete the old alias and CreateAlias to create * a new alias.

You cannot use UpdateAlias to change an alias name. To change an alias name, * use DeleteAlias to delete the old alias and CreateAlias to * create a new alias.

Because an alias is not a property of a KMS key, you can create, update, and delete the * aliases of a KMS key without affecting the KMS key. Also, aliases do not appear in the * response from the DescribeKey operation. To get the aliases of all KMS keys * in the account, use the ListAliases operation.

The KMS key that you use for this operation must be in a compatible key state. For * details, see Key states of KMS keys in the Key Management Service Developer Guide.

* Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.

* Required permissions *

*
* kms:UpdateAlias on * the alias (IAM policy).
*
*
* kms:UpdateAlias on * the current KMS key (key policy).
*
*
* kms:UpdateAlias on * the new KMS key (key policy).
*

For details, see Controlling access to aliases in the * Key Management Service Developer Guide.

* Related operations: *

*
* CreateAlias *
*
*
* DeleteAlias *
*
*
* ListAliases *
*

* Eventual consistency: The KMS API follows an eventual consistency model. * For more information, see KMS eventual consistency.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript * import { KMSClient, UpdateAliasCommand } from "@aws-sdk/client-kms"; // ES Modules import * // const { KMSClient, UpdateAliasCommand } = require("@aws-sdk/client-kms"); // CommonJS import * // import type { KMSClientConfig } from "@aws-sdk/client-kms"; * const config = {}; // type is KMSClientConfig * const client = new KMSClient(config); * const input = { // UpdateAliasRequest * AliasName: "STRING_VALUE", // required * TargetKeyId: "STRING_VALUE", // required * }; * const command = new UpdateAliasCommand(input); * const response = await client.send(command); * // {}; * * ``` * * @param UpdateAliasCommandInput - {@link UpdateAliasCommandInput} * @returns {@link UpdateAliasCommandOutput} * @see {@link UpdateAliasCommandInput} for command's `input` shape. * @see {@link UpdateAliasCommandOutput} for command's `response` shape. * @see {@link KMSClientResolvedConfig | config} for KMSClient's `config` shape. * * @throws {@link DependencyTimeoutException} (server fault) *

The system timed out while trying to fulfill the request. You can retry the * request.

* * @throws {@link KMSInternalException} (server fault) *

The request was rejected because an internal exception occurred. The request can be * retried.

* * @throws {@link KMSInvalidStateException} (client fault) *

The request was rejected because the state of the specified resource is not valid for this * request.

This exceptions means one of the following:

*
The key state of the KMS key is not compatible with the operation.
*
To find the key state, use the DescribeKey operation. For more * information about which key states are compatible with each KMS operation, see * Key states of KMS keys in the * Key Management Service Developer Guide * .
*
*
For cryptographic operations on KMS keys in custom key stores, this exception * represents a general failure with many possible causes. To identify the cause, see the * error message that accompanies the exception.
*

* * @throws {@link LimitExceededException} (client fault) *

The request was rejected because a length constraint or quota was exceeded. For more * information, see Quotas in * the Key Management Service Developer Guide.

* * @throws {@link NotFoundException} (client fault) *

The request was rejected because the specified entity or resource could not be * found.

* * @throws {@link KMSServiceException} *

Base exception class for all service exceptions from KMS service.

* * * @example To update an alias * ```javascript * // The following example updates the specified alias to refer to the specified KMS key. * const input = { * AliasName: "alias/ExampleAlias", * TargetKeyId: "1234abcd-12ab-34cd-56ef-1234567890ab" * }; * const command = new UpdateAliasCommand(input); * const response = await client.send(command); * /* response is * { /* metadata only *\/ } * *\/ * ``` * * @public */ export declare class UpdateAliasCommand extends UpdateAliasCommand_base { /** @internal type navigation helper, not in runtime. */ protected static __types: { api: { input: UpdateAliasRequest; output: {}; }; sdk: { input: UpdateAliasCommandInput; output: UpdateAliasCommandOutput; }; }; }