Skip to content

Commit b83f5f9

Browse files
author
awstools
committed
feat(client-backup): AWS Backup now supports customer-managed keys (CMK) for logically air-gapped vaults, enabling customers to maintain full control over their encryption key lifecycle. This feature helps organizations meet specific internal governance requirements or external regulatory compliance standards.
1 parent 64e9c61 commit b83f5f9

File tree

9 files changed

+127
-4
lines changed

9 files changed

+127
-4
lines changed

clients/client-backup/src/commands/CreateLogicallyAirGappedBackupVaultCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ export interface CreateLogicallyAirGappedBackupVaultCommandOutput
6161
* CreatorRequestId: "STRING_VALUE",
6262
* MinRetentionDays: Number("long"), // required
6363
* MaxRetentionDays: Number("long"), // required
64+
* EncryptionKeyArn: "STRING_VALUE",
6465
* };
6566
* const command = new CreateLogicallyAirGappedBackupVaultCommand(input);
6667
* const response = await client.send(command);

clients/client-backup/src/commands/DescribeBackupVaultCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ export interface DescribeBackupVaultCommandOutput extends DescribeBackupVaultOut
6666
* // InitiationDate: new Date("TIMESTAMP"),
6767
* // ExpiryDate: new Date("TIMESTAMP"),
6868
* // },
69+
* // EncryptionKeyType: "AWS_OWNED_KMS_KEY" || "CUSTOMER_MANAGED_KMS_KEY",
6970
* // };
7071
*
7172
* ```

clients/client-backup/src/commands/DescribeRecoveryPointCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ export interface DescribeRecoveryPointCommandOutput extends DescribeRecoveryPoin
8989
* // VaultType: "BACKUP_VAULT" || "LOGICALLY_AIR_GAPPED_BACKUP_VAULT" || "RESTORE_ACCESS_BACKUP_VAULT",
9090
* // IndexStatus: "PENDING" || "ACTIVE" || "FAILED" || "DELETING",
9191
* // IndexStatusMessage: "STRING_VALUE",
92+
* // EncryptionKeyType: "AWS_OWNED_KMS_KEY" || "CUSTOMER_MANAGED_KMS_KEY",
9293
* // };
9394
*
9495
* ```

clients/client-backup/src/commands/ListBackupVaultsCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ export interface ListBackupVaultsCommandOutput extends ListBackupVaultsOutput, _
6161
* // MinRetentionDays: Number("long"),
6262
* // MaxRetentionDays: Number("long"),
6363
* // LockDate: new Date("TIMESTAMP"),
64+
* // EncryptionKeyType: "AWS_OWNED_KMS_KEY" || "CUSTOMER_MANAGED_KMS_KEY",
6465
* // },
6566
* // ],
6667
* // NextToken: "STRING_VALUE",

clients/client-backup/src/commands/ListRecoveryPointsByBackupVaultCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ export interface ListRecoveryPointsByBackupVaultCommandOutput
102102
* // VaultType: "BACKUP_VAULT" || "LOGICALLY_AIR_GAPPED_BACKUP_VAULT" || "RESTORE_ACCESS_BACKUP_VAULT",
103103
* // IndexStatus: "PENDING" || "ACTIVE" || "FAILED" || "DELETING",
104104
* // IndexStatusMessage: "STRING_VALUE",
105+
* // EncryptionKeyType: "AWS_OWNED_KMS_KEY" || "CUSTOMER_MANAGED_KMS_KEY",
105106
* // },
106107
* // ],
107108
* // };

clients/client-backup/src/commands/ListRecoveryPointsByResourceCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ export interface ListRecoveryPointsByResourceCommandOutput
7272
* // VaultType: "BACKUP_VAULT" || "LOGICALLY_AIR_GAPPED_BACKUP_VAULT" || "RESTORE_ACCESS_BACKUP_VAULT",
7373
* // IndexStatus: "PENDING" || "ACTIVE" || "FAILED" || "DELETING",
7474
* // IndexStatusMessage: "STRING_VALUE",
75+
* // EncryptionKeyType: "AWS_OWNED_KMS_KEY" || "CUSTOMER_MANAGED_KMS_KEY",
7576
* // },
7677
* // ],
7778
* // };

clients/client-backup/src/models/models_0.ts

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1496,6 +1496,20 @@ export const BackupVaultEvent = {
14961496
*/
14971497
export type BackupVaultEvent = (typeof BackupVaultEvent)[keyof typeof BackupVaultEvent];
14981498

1499+
/**
1500+
* @public
1501+
* @enum
1502+
*/
1503+
export const EncryptionKeyType = {
1504+
AWS_OWNED_KMS_KEY: "AWS_OWNED_KMS_KEY",
1505+
CUSTOMER_MANAGED_KMS_KEY: "CUSTOMER_MANAGED_KMS_KEY",
1506+
} as const;
1507+
1508+
/**
1509+
* @public
1510+
*/
1511+
export type EncryptionKeyType = (typeof EncryptionKeyType)[keyof typeof EncryptionKeyType];
1512+
14991513
/**
15001514
* @public
15011515
* @enum
@@ -1644,6 +1658,12 @@ export interface BackupVaultListMember {
16441658
* @public
16451659
*/
16461660
LockDate?: Date | undefined;
1661+
1662+
/**
1663+
* <p>The type of encryption key used for the backup vault. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>
1664+
* @public
1665+
*/
1666+
EncryptionKeyType?: EncryptionKeyType | undefined;
16471667
}
16481668

16491669
/**
@@ -2676,6 +2696,12 @@ export interface CreateLogicallyAirGappedBackupVaultInput {
26762696
* @public
26772697
*/
26782698
MaxRetentionDays: number | undefined;
2699+
2700+
/**
2701+
* <p>The ARN of the customer-managed KMS key to use for encrypting the logically air-gapped backup vault. If not specified, the vault will be encrypted with an Amazon Web Services-owned key managed by Amazon Web Services Backup.</p>
2702+
* @public
2703+
*/
2704+
EncryptionKeyArn?: string | undefined;
26792705
}
26802706

26812707
/**
@@ -3349,6 +3375,8 @@ export interface RestoreTestingSelectionForCreate {
33493375
/**
33503376
* <p>The unique name of the restore testing selection
33513377
* that belongs to the related restore testing plan.</p>
3378+
* <p>The name consists of only alphanumeric characters and underscores.
3379+
* Maximum length is 50.</p>
33523380
* @public
33533381
*/
33543382
RestoreTestingSelectionName: string | undefined;
@@ -3434,6 +3462,8 @@ export interface CreateRestoreTestingSelectionOutput {
34343462

34353463
/**
34363464
* <p>The name of the restore testing selection for the related restore testing plan.</p>
3465+
* <p>The name cannot be changed after creation. The name consists of only
3466+
* alphanumeric characters and underscores. Maximum length is 50.</p>
34373467
* @public
34383468
*/
34393469
RestoreTestingSelectionName: string | undefined;
@@ -4158,6 +4188,12 @@ export interface DescribeBackupVaultOutput {
41584188
* @public
41594189
*/
41604190
LatestMpaApprovalTeamUpdate?: LatestMpaApprovalTeamUpdate | undefined;
4191+
4192+
/**
4193+
* <p>The type of encryption key used for the backup vault. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>
4194+
* @public
4195+
*/
4196+
EncryptionKeyType?: EncryptionKeyType | undefined;
41614197
}
41624198

41634199
/**
@@ -4719,6 +4755,12 @@ export interface DescribeRecoveryPointOutput {
47194755
* @public
47204756
*/
47214757
IndexStatusMessage?: string | undefined;
4758+
4759+
/**
4760+
* <p>The type of encryption key used for the recovery point. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>
4761+
* @public
4762+
*/
4763+
EncryptionKeyType?: EncryptionKeyType | undefined;
47224764
}
47234765

47244766
/**
@@ -6136,6 +6178,8 @@ export interface RestoreTestingSelectionForGet {
61366178
/**
61376179
* <p>The unique name of the restore testing selection that
61386180
* belongs to the related restore testing plan.</p>
6181+
* <p>The name consists of only alphanumeric characters and underscores.
6182+
* Maximum length is 50.</p>
61396183
* @public
61406184
*/
61416185
RestoreTestingSelectionName: string | undefined;
@@ -8019,6 +8063,12 @@ export interface RecoveryPointByBackupVault {
80198063
* @public
80208064
*/
80218065
IndexStatusMessage?: string | undefined;
8066+
8067+
/**
8068+
* <p>The type of encryption key used for the recovery point. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>
8069+
* @public
8070+
*/
8071+
EncryptionKeyType?: EncryptionKeyType | undefined;
80228072
}
80238073

80248074
/**
@@ -8263,6 +8313,12 @@ export interface RecoveryPointByResource {
82638313
* @public
82648314
*/
82658315
IndexStatusMessage?: string | undefined;
8316+
8317+
/**
8318+
* <p>The type of encryption key used for the recovery point. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>
8319+
* @public
8320+
*/
8321+
EncryptionKeyType?: EncryptionKeyType | undefined;
82668322
}
82678323

82688324
/**
@@ -9294,6 +9350,8 @@ export interface RestoreTestingSelectionForList {
92949350

92959351
/**
92969352
* <p>Unique name of a restore testing selection.</p>
9353+
* <p>The name consists of only alphanumeric characters and underscores.
9354+
* Maximum length is 50.</p>
92979355
* @public
92989356
*/
92999357
RestoreTestingSelectionName: string | undefined;

clients/client-backup/src/protocols/Aws_restJson1.ts

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -560,6 +560,7 @@ export const se_CreateLogicallyAirGappedBackupVaultCommand = async (
560560
take(input, {
561561
BackupVaultTags: (_) => _json(_),
562562
CreatorRequestId: [true, (_) => _ ?? generateIdempotencyToken()],
563+
EncryptionKeyArn: [],
563564
MaxRetentionDays: [],
564565
MinRetentionDays: [],
565566
})
@@ -2968,6 +2969,7 @@ export const de_DescribeBackupVaultCommand = async (
29682969
CreationDate: (_) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
29692970
CreatorRequestId: __expectString,
29702971
EncryptionKeyArn: __expectString,
2972+
EncryptionKeyType: __expectString,
29712973
LatestMpaApprovalTeamUpdate: (_) => de_LatestMpaApprovalTeamUpdate(_, context),
29722974
LockDate: (_) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
29732975
Locked: __expectBoolean,
@@ -3108,6 +3110,7 @@ export const de_DescribeRecoveryPointCommand = async (
31083110
CreatedBy: _json,
31093111
CreationDate: (_) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
31103112
EncryptionKeyArn: __expectString,
3113+
EncryptionKeyType: __expectString,
31113114
IamRoleArn: __expectString,
31123115
IndexStatus: __expectString,
31133116
IndexStatusMessage: __expectString,
@@ -5233,6 +5236,7 @@ const de_BackupVaultListMember = (output: any, context: __SerdeContext): BackupV
52335236
CreationDate: (_: any) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
52345237
CreatorRequestId: __expectString,
52355238
EncryptionKeyArn: __expectString,
5239+
EncryptionKeyType: __expectString,
52365240
LockDate: (_: any) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
52375241
Locked: __expectBoolean,
52385242
MaxRetentionDays: __expectLong,
@@ -5531,6 +5535,7 @@ const de_RecoveryPointByBackupVault = (output: any, context: __SerdeContext): Re
55315535
CreatedBy: _json,
55325536
CreationDate: (_: any) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
55335537
EncryptionKeyArn: __expectString,
5538+
EncryptionKeyType: __expectString,
55345539
IamRoleArn: __expectString,
55355540
IndexStatus: __expectString,
55365541
IndexStatusMessage: __expectString,
@@ -5572,6 +5577,7 @@ const de_RecoveryPointByResource = (output: any, context: __SerdeContext): Recov
55725577
BackupVaultName: __expectString,
55735578
CreationDate: (_: any) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
55745579
EncryptionKeyArn: __expectString,
5580+
EncryptionKeyType: __expectString,
55755581
IndexStatus: __expectString,
55765582
IndexStatusMessage: __expectString,
55775583
IsParent: __expectBoolean,

codegen/sdk-codegen/aws-models/backup.json

Lines changed: 57 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1260,6 +1260,12 @@
12601260
"traits": {
12611261
"smithy.api#documentation": "<p>The date and time when Backup Vault Lock configuration becomes immutable,\n meaning it cannot be changed or deleted.</p>\n <p>If you applied Vault Lock to your vault without specifying a lock date, you can change\n your Vault Lock settings, or delete Vault Lock from the vault entirely, at any time.</p>\n <p>This value is in Unix format, Coordinated Universal Time (UTC), and accurate to\n milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018\n 12:11:30.087 AM.</p>"
12621262
}
1263+
},
1264+
"EncryptionKeyType": {
1265+
"target": "com.amazonaws.backup#EncryptionKeyType",
1266+
"traits": {
1267+
"smithy.api#documentation": "<p>The type of encryption key used for the backup vault. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>"
1268+
}
12631269
}
12641270
},
12651271
"traits": {
@@ -2526,6 +2532,12 @@
25262532
"smithy.api#documentation": "<p>The maximum retention period that the vault retains its recovery points.</p>",
25272533
"smithy.api#required": {}
25282534
}
2535+
},
2536+
"EncryptionKeyArn": {
2537+
"target": "com.amazonaws.backup#ARN",
2538+
"traits": {
2539+
"smithy.api#documentation": "<p>The ARN of the customer-managed KMS key to use for encrypting the logically air-gapped backup vault. If not specified, the vault will be encrypted with an Amazon Web Services-owned key managed by Amazon Web Services Backup.</p>"
2540+
}
25292541
}
25302542
},
25312543
"traits": {
@@ -2974,7 +2986,7 @@
29742986
"RestoreTestingSelectionName": {
29752987
"target": "smithy.api#String",
29762988
"traits": {
2977-
"smithy.api#documentation": "<p>The name of the restore testing selection for the related restore testing plan.</p>",
2989+
"smithy.api#documentation": "<p>The name of the restore testing selection for the related restore testing plan.</p>\n <p>The name cannot be changed after creation. The name consists of only \n alphanumeric characters and underscores. Maximum length is 50.</p>",
29782990
"smithy.api#required": {}
29792991
}
29802992
}
@@ -5230,6 +5242,12 @@
52305242
"traits": {
52315243
"smithy.api#documentation": "<p>Information about the latest update to the MPA approval team association for this backup vault.</p>"
52325244
}
5245+
},
5246+
"EncryptionKeyType": {
5247+
"target": "com.amazonaws.backup#EncryptionKeyType",
5248+
"traits": {
5249+
"smithy.api#documentation": "<p>The type of encryption key used for the backup vault. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>"
5250+
}
52335251
}
52345252
},
52355253
"traits": {
@@ -5792,6 +5810,12 @@
57925810
"traits": {
57935811
"smithy.api#documentation": "<p>A string in the form of a detailed message explaining the status of a backup index\n associated with the recovery point.</p>"
57945812
}
5813+
},
5814+
"EncryptionKeyType": {
5815+
"target": "com.amazonaws.backup#EncryptionKeyType",
5816+
"traits": {
5817+
"smithy.api#documentation": "<p>The type of encryption key used for the recovery point. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>"
5818+
}
57955819
}
57965820
},
57975821
"traits": {
@@ -6326,6 +6350,23 @@
63266350
"smithy.api#input": {}
63276351
}
63286352
},
6353+
"com.amazonaws.backup#EncryptionKeyType": {
6354+
"type": "enum",
6355+
"members": {
6356+
"AWS_OWNED_KMS_KEY": {
6357+
"target": "smithy.api#Unit",
6358+
"traits": {
6359+
"smithy.api#enumValue": "AWS_OWNED_KMS_KEY"
6360+
}
6361+
},
6362+
"CUSTOMER_MANAGED_KMS_KEY": {
6363+
"target": "smithy.api#Unit",
6364+
"traits": {
6365+
"smithy.api#enumValue": "CUSTOMER_MANAGED_KMS_KEY"
6366+
}
6367+
}
6368+
}
6369+
},
63296370
"com.amazonaws.backup#ExportBackupPlanTemplate": {
63306371
"type": "operation",
63316372
"input": {
@@ -11310,6 +11351,12 @@
1131011351
"traits": {
1131111352
"smithy.api#documentation": "<p>A string in the form of a detailed message explaining the status of a backup index associated \n with the recovery point.</p>"
1131211353
}
11354+
},
11355+
"EncryptionKeyType": {
11356+
"target": "com.amazonaws.backup#EncryptionKeyType",
11357+
"traits": {
11358+
"smithy.api#documentation": "<p>The type of encryption key used for the recovery point. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>"
11359+
}
1131311360
}
1131411361
},
1131511362
"traits": {
@@ -11403,6 +11450,12 @@
1140311450
"traits": {
1140411451
"smithy.api#documentation": "<p>A string in the form of a detailed message explaining the status of a backup index\n associated with the recovery point.</p>"
1140511452
}
11453+
},
11454+
"EncryptionKeyType": {
11455+
"target": "com.amazonaws.backup#EncryptionKeyType",
11456+
"traits": {
11457+
"smithy.api#documentation": "<p>The type of encryption key used for the recovery point. Valid values are CUSTOMER_MANAGED_KMS_KEY for customer-managed keys or Amazon Web Services_OWNED_KMS_KEY for Amazon Web Services-owned keys.</p>"
11458+
}
1140611459
}
1140711460
},
1140811461
"traits": {
@@ -12611,7 +12664,7 @@
1261112664
"RestoreTestingSelectionName": {
1261212665
"target": "smithy.api#String",
1261312666
"traits": {
12614-
"smithy.api#documentation": "<p>The unique name of the restore testing selection \n that belongs to the related restore testing plan.</p>",
12667+
"smithy.api#documentation": "<p>The unique name of the restore testing selection \n that belongs to the related restore testing plan.</p>\n <p>The name consists of only alphanumeric characters and underscores. \n Maximum length is 50.</p>",
1261512668
"smithy.api#required": {}
1261612669
}
1261712670
},
@@ -12685,7 +12738,7 @@
1268512738
"RestoreTestingSelectionName": {
1268612739
"target": "smithy.api#String",
1268712740
"traits": {
12688-
"smithy.api#documentation": "<p>The unique name of the restore testing selection that \n belongs to the related restore testing plan.</p>",
12741+
"smithy.api#documentation": "<p>The unique name of the restore testing selection that \n belongs to the related restore testing plan.</p>\n <p>The name consists of only alphanumeric characters and underscores. \n Maximum length is 50.</p>",
1268912742
"smithy.api#required": {}
1269012743
}
1269112744
},
@@ -12735,7 +12788,7 @@
1273512788
"RestoreTestingSelectionName": {
1273612789
"target": "smithy.api#String",
1273712790
"traits": {
12738-
"smithy.api#documentation": "<p>Unique name of a restore testing selection.</p>",
12791+
"smithy.api#documentation": "<p>Unique name of a restore testing selection.</p>\n <p>The name consists of only alphanumeric characters and underscores. \n Maximum length is 50.</p>",
1273912792
"smithy.api#required": {}
1274012793
}
1274112794
},

0 commit comments

Comments
 (0)