• Creates an alias that is associated with an AWS KMS key.

    Parameters

    • params: {
          alias: string;
          awsKeyId: string;
          kmsClient: KMSClient;
      }

      The parameters for creating the key alias.

      • alias: string

        The name of the key alias.

      • awsKeyId: string

        The AWS Key ID or AWS Key ARN of the key to associate the alias with.

      • kmsClient: KMSClient

    Returns Promise<void>

    A promise that resolves when the key alias has been created.

    Remarks

    This method creates an alias (friendly name) for identifying an AWS KMS customer managed key. The method requires an alias name and an AWS key identifier (either a key ID or key ARN).

    This library uses the AWS KMS alias feature to make it possible to reference a key using a URI (Uniform Resource Identifier) that is consistent across all implementations of CryptoApi. These key URIs take the form urn:jwk:<JWK thumbprint>, where the JWK thumbprint is deterministically computed from the JWK (JSON Web Key) representation of the key. In other words, the same key material represented as a JWK will always produce the same JWK thumbprint regardless of the order of JWK properties or inclusion of optional properties. Due to AWS KMS restrictions on key alias names, the JWK thumbprint is prepended with the "alias/" prefix and the URN namespace separator is replaced with dashes.

    Alias name restrictions imposed by AWS KMS:

    • must be a string of 1-256 characters
    • can contain only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-)
    • must begin with alias/ followed by a name, such as alias/ExampleAlias
    • cannot begin with alias/aws/ because this prefix is reserved for AWS managed keys
    • must be unique within an AWS account and region.

    Throws

    AlreadyExistsException if the alias already exists. Each AWS KMS key alias must be unique in the account and region.

    Throws

    InvalidAliasNameException if the alias name is invalid. The alias name value must be string of 1-256 characters containing only alphanumeric characters, forward slashes (/), underscores (_), and dashes (-).

    Throws

    NotFoundException if the AWS Key ID or AWS Key ARN could not be found in the account and region.

    Throws

    Other AWS KMS related errors.