DeriveSharedSecret

Source: src/AWS/KMS/DeriveSharedSecret.ts

Runtime binding for kms:DeriveSharedSecret.

Bind this operation to a KEY_AGREEMENT KMS Key (or the alias/... name of a pre-existing key) to get a callable that automatically injects the KeyId. Runs ECDH between the bound key’s private key (inside KMS) and a peer’s public key, returning the raw shared secret for use with a key-derivation function.

The SharedSecret in the response is wrapped in Redacted so it never leaks into logs — unwrap with Redacted.value(...) at the point of use.

Key Agreement

const deriveSharedSecret = yield* AWS.KMS.DeriveSharedSecret(agreementKey);

const { SharedSecret } = yield* deriveSharedSecret({
  KeyAgreementAlgorithm: "ECDH",
  PublicKey: peerPublicKeyDer, // DER-encoded SubjectPublicKeyInfo
});