Sign

Source: src/AWS/KMS/Sign.ts

Runtime binding for kms:Sign.

Bind this operation to an asymmetric SIGN_VERIFY KMS Key (or the alias/... name of a pre-existing key) to get a callable that automatically injects the KeyId. The private key never leaves KMS — the signature is produced inside the HSM.

Signing

Sign a Message

const sign = yield* AWS.KMS.Sign(signingKey);

const { Signature } = yield* sign({
  Message: new TextEncoder().encode("release-manifest-v1"),
  SigningAlgorithm: "ECDSA_SHA_256",
});

Sign a Pre-Computed Digest

// For payloads larger than 4096 bytes, hash locally and sign the digest.
const { Signature } = yield* sign({
  Message: sha256Digest,
  MessageType: "DIGEST",
  SigningAlgorithm: "ECDSA_SHA_256",
});