TranslateKeyMaterial

Source: src/AWS/PaymentCryptography/TranslateKeyMaterial.ts

Runtime binding for payment-cryptography:TranslateKeyMaterial — translates an ECDH-derived TR-31 wrapped key block into a TR-31 key block wrapped under a Key Encryption Key, without importing the short-lived key into the service. The key identifiers live in nested request structures (IncomingKeyMaterial.DiffieHellmanTr31KeyBlock.PrivateKeyIdentifier, OutgoingKeyMaterial.Tr31KeyBlock.WrappingKeyIdentifier), so the caller supplies the full request; bind every Key the request references so the Function is granted the action on each. Provide TranslateKeyMaterialHttp on the Function to satisfy this service.

Key Material Translation

// init — grant on every key the request references
const translateKeyMaterial =
  yield* PaymentCryptography.TranslateKeyMaterial(ecdhPrivateKey, caKey, kek);
const ecdhPrivateKeyArn = yield* ecdhPrivateKey.keyArn;
const caKeyArn = yield* caKey.keyArn;
const kekArn = yield* kek.keyArn;

// runtime
const translated = yield* translateKeyMaterial({
  IncomingKeyMaterial: {
    DiffieHellmanTr31KeyBlock: {
      PrivateKeyIdentifier: yield* ecdhPrivateKeyArn,
      CertificateAuthorityPublicKeyIdentifier: yield* caKeyArn,
      // ...
    },
  },
  OutgoingKeyMaterial: { Tr31KeyBlock: { WrappingKeyIdentifier: yield* kekArn } },
});