GenerateMac

Source: src/AWS/KMS/GenerateMac.ts

Runtime binding for kms:GenerateMac.

Bind this operation to an HMAC KMS Key (or the alias/... name of a pre-existing key) to get a callable that automatically injects the KeyId. Computes an HMAC inside KMS — the MAC key never leaves the HSM, so any party with kms:VerifyMac can validate tokens without ever holding the shared secret.

Message Authentication

const generateMac = yield* AWS.KMS.GenerateMac(hmacKey);

const { Mac } = yield* generateMac({
  Message: new TextEncoder().encode("session-token-payload"),
  MacAlgorithm: "HMAC_SHA_256",
});