Key

Source: src/AWS/PaymentCryptography/Key.ts

An AWS Payment Cryptography key — a managed cryptographic key with TR-31 attributes (algorithm, class, usage, modes of use) used for data encryption, MAC generation/verification, and other payment-domain cryptographic operations.

The key ARN is auto-assigned by the service; attach an Alias for a stable human-readable identifier. Deletion schedules the key for removal after a waiting window (minimum 3 days) during which it can be restored.

Creating Keys

Symmetric data-encryption key

import * as PaymentCryptography from "alchemy/AWS/PaymentCryptography";

const key = yield* PaymentCryptography.Key("DataKey", {
  keyAttributes: {
    keyAlgorithm: "AES_128",
    keyClass: "SYMMETRIC_KEY",
    keyUsage: "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY",
    keyModesOfUse: { encrypt: true, decrypt: true, wrap: true, unwrap: true },
  },
});

HMAC key for MAC generation and verification

const macKey = yield* PaymentCryptography.Key("MacKey", {
  keyAttributes: {
    keyAlgorithm: "HMAC_SHA256",
    keyClass: "SYMMETRIC_KEY",
    keyUsage: "TR31_M7_HMAC_KEY",
    keyModesOfUse: { generate: true, verify: true },
  },
});

Managing Key State

const key = yield* PaymentCryptography.Key("DataKey", {
  keyAttributes: { ... },
  enabled: false,
});

Using Keys at Runtime

// init
const encrypt = yield* PaymentCryptography.EncryptData(key);

return {
  fetch: Effect.gen(function* () {
    // runtime — PlainText is hex-encoded
    const result = yield* encrypt({
      PlainText: "31323334353637383930313233343536",
      EncryptionAttributes: { Symmetric: { Mode: "CBC" } },
    });
    return HttpServerResponse.json({ cipherText: result.CipherText });
  }),
};