GenerateDataKeyPairWithoutPlaintext

Source: src/AWS/KMS/GenerateDataKeyPairWithoutPlaintext.ts

Runtime binding for kms:GenerateDataKeyPairWithoutPlaintext.

Bind this operation to a symmetric-encryption KMS Key (or the alias/... name of a pre-existing key) to get a callable that automatically injects the KeyId. Returns the public key and the private key encrypted under the bound symmetric key — the plaintext private key never exists in this process; decrypt the blob later with the Decrypt binding where it is actually needed.

Data Key Pairs

const generatePair = yield* AWS.KMS.GenerateDataKeyPairWithoutPlaintext(key);

const pair = yield* generatePair({ KeyPairSpec: "ECC_NIST_P256" });
// pair.PublicKey                — hand out for encryption/verification
// pair.PrivateKeyCiphertextBlob — persist for the consuming service