GenerateDataKeyPair

Source: src/AWS/KMS/GenerateDataKeyPair.ts

Runtime binding for kms:GenerateDataKeyPair.

Bind this operation to a symmetric-encryption KMS Key (or the alias/... name of a pre-existing key) to get a callable that automatically injects the KeyId. Returns a fresh asymmetric key pair: the public key and plaintext private key for immediate local use, plus the private key encrypted under the bound symmetric key for storage.

The PrivateKeyPlaintext in the response is wrapped in Redacted so it never leaks into logs — unwrap with Redacted.value(...) at the point of use and discard it as soon as the local operation is done.

Data Key Pairs

const generateDataKeyPair = yield* AWS.KMS.GenerateDataKeyPair(key);

const pair = yield* generateDataKeyPair({ KeyPairSpec: "RSA_2048" });
// pair.PublicKey            — DER-encoded public key
// pair.PrivateKeyPlaintext  — Redacted; use locally then discard
// pair.PrivateKeyCiphertextBlob — persist; recover via the Decrypt binding