GenerateDataKeyWithoutPlaintext

Source: src/AWS/KMS/GenerateDataKeyWithoutPlaintext.ts

Runtime binding for kms:GenerateDataKeyWithoutPlaintext.

Bind this operation to a KMS Key (or the alias/... name of a pre-existing key) to get a callable that automatically injects the KeyId. Returns ONLY the encrypted copy of a fresh data key — use it in the component that provisions envelope keys but must never see key material; the consumer decrypts the blob later with the Decrypt binding.

Envelope Encryption

const generateDataKeyWithoutPlaintext =
  yield* AWS.KMS.GenerateDataKeyWithoutPlaintext(key);

const { CiphertextBlob } = yield* generateDataKeyWithoutPlaintext({
  KeySpec: "AES_256",
});
// store CiphertextBlob next to the data; no plaintext ever existed here

Pre-Existing Keys

const generate = yield* AWS.KMS.GenerateDataKeyWithoutPlaintext("alias/app-key");