Verify

Source: src/AWS/KMS/Verify.ts

Runtime binding for kms:Verify.

Bind this operation to an asymmetric SIGN_VERIFY KMS Key (or the alias/... name of a pre-existing key) to get a callable that automatically injects the KeyId. Verifying inside KMS (rather than with a downloaded public key) means the result is authorized and auditable by IAM/CloudTrail.

A mismatched signature surfaces as the typed KMSInvalidSignatureException — a valid signature returns SignatureValid: true.

Signing

Verify a Signature

const verify = yield* AWS.KMS.Verify(signingKey);

const { SignatureValid } = yield* verify({
  Message: new TextEncoder().encode("release-manifest-v1"),
  Signature: signature,
  SigningAlgorithm: "ECDSA_SHA_256",
});

Treat a Bad Signature as a Value

const valid = yield* verify({ Message, Signature, SigningAlgorithm }).pipe(
  Effect.map(() => true),
  Effect.catchTag("KMSInvalidSignatureException", () =>
    Effect.succeed(false),
  ),
);