VerifyMac

Source: src/AWS/KMS/VerifyMac.ts

Runtime binding for kms:VerifyMac.

Bind this operation to an HMAC KMS Key (or the alias/... name of a pre-existing key) to get a callable that automatically injects the KeyId. A mismatched MAC surfaces as the typed KMSInvalidMacException — a valid MAC returns MacValid: true.

Message Authentication

Verify an HMAC

const verifyMac = yield* AWS.KMS.VerifyMac(hmacKey);

const { MacValid } = yield* verifyMac({
  Message: new TextEncoder().encode("session-token-payload"),
  Mac: mac,
  MacAlgorithm: "HMAC_SHA_256",
});

Treat a Bad MAC as a Value

const valid = yield* verifyMac({ Message, Mac, MacAlgorithm }).pipe(
  Effect.map(() => true),
  Effect.catchTag("KMSInvalidMacException", () => Effect.succeed(false)),
);