GenerateRandom

Source: src/AWS/KMS/GenerateRandom.ts

Runtime binding for kms:GenerateRandom.

Not scoped to a key — KMS produces cryptographically secure random bytes from its FIPS 140-3 validated HSMs. The binding grants kms:GenerateRandom on * (the action does not support resource-level scoping).

The random Plaintext in the response is wrapped in Redacted so it never leaks into logs — unwrap with Redacted.value(...) at the point of use.

Random Bytes

import * as Redacted from "effect/Redacted";

const generateRandom = yield* AWS.KMS.GenerateRandom();

const { Plaintext } = yield* generateRandom({ NumberOfBytes: 32 });
const bytes = Redacted.isRedacted(Plaintext)
  ? Redacted.value(Plaintext)
  : Plaintext;