Copyright	(c) 2013-2023 Brendan Hay
License	Mozilla Public License, v. 2.0.
Maintainer	Brendan Hay
Stability	auto-generated
Portability	non-portable (GHC extensions)
Safe Haskell	Safe-Inferred
Language	Haskell2010

Amazonka.Route53.CreateKeySigningKey

Contents

Creating a Request
Request Lenses
Destructuring the Response
Response Lenses

Description

Creates a new key-signing key (KSK) associated with a hosted zone. You can only have two KSKs per hosted zone.

Synopsis

data CreateKeySigningKey = CreateKeySigningKey' {
- callerReference :: Text
- hostedZoneId :: ResourceId
- keyManagementServiceArn :: Text
- name :: Text
- status :: Text
}
newCreateKeySigningKey :: Text -> ResourceId -> Text -> Text -> Text -> CreateKeySigningKey
createKeySigningKey_callerReference :: Lens' CreateKeySigningKey Text
createKeySigningKey_hostedZoneId :: Lens' CreateKeySigningKey ResourceId
createKeySigningKey_keyManagementServiceArn :: Lens' CreateKeySigningKey Text
createKeySigningKey_name :: Lens' CreateKeySigningKey Text
createKeySigningKey_status :: Lens' CreateKeySigningKey Text
data CreateKeySigningKeyResponse = CreateKeySigningKeyResponse' {
- httpStatus :: Int
- changeInfo :: ChangeInfo
- keySigningKey :: KeySigningKey
- location :: Text
}
newCreateKeySigningKeyResponse :: Int -> ChangeInfo -> KeySigningKey -> Text -> CreateKeySigningKeyResponse
createKeySigningKeyResponse_httpStatus :: Lens' CreateKeySigningKeyResponse Int
createKeySigningKeyResponse_changeInfo :: Lens' CreateKeySigningKeyResponse ChangeInfo
createKeySigningKeyResponse_keySigningKey :: Lens' CreateKeySigningKeyResponse KeySigningKey
createKeySigningKeyResponse_location :: Lens' CreateKeySigningKeyResponse Text

Creating a Request

data CreateKeySigningKey Source #

See: newCreateKeySigningKey smart constructor.

Constructors

CreateKeySigningKey'

Fields

callerReference :: Text
A unique string that identifies the request.
hostedZoneId :: ResourceId
The unique string (ID) used to identify a hosted zone.
keyManagementServiceArn :: Text
The Amazon resource name (ARN) for a customer managed key in Key Management Service (KMS). The KeyManagementServiceArn must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of KeyManagementServiceArn that grants the correct permissions for DNSSEC, scroll down to Example.
You must configure the customer managed customer managed key as follows:
Status
Enabled
Key spec
ECC_NIST_P256
Key usage
Sign and verify
Key policy
The key policy must give permission for the following actions:
- DescribeKey
- GetPublicKey
- Sign
The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:
- "Service": "dnssec-route53.amazonaws.com"
For more information about working with a customer managed key in KMS, see Key Management Service concepts.
name :: Text
A string used to identify a key-signing key (KSK). Name can include numbers, letters, and underscores (_). Name must be unique for each key-signing key in the same hosted zone.
status :: Text
A string specifying the initial status of the key-signing key (KSK). You can set the value to ACTIVE or INACTIVE.

Instances

Instances details

ToHeaders CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toHeaders :: CreateKeySigningKey -> [Header] #
ToPath CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toPath :: CreateKeySigningKey -> ByteString #
ToQuery CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toQuery :: CreateKeySigningKey -> QueryString #
ToElement CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toElement :: CreateKeySigningKey -> Element #
ToXML CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods toXML :: CreateKeySigningKey -> XML #
AWSRequest CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Associated Types type AWSResponse CreateKeySigningKey # Methods request :: (Service -> Service) -> CreateKeySigningKey -> Request CreateKeySigningKey # response :: MonadResource m => (ByteStringLazy -> IO ByteStringLazy) -> Service -> Proxy CreateKeySigningKey -> ClientResponse ClientBody -> m (Either Error (ClientResponse (AWSResponse CreateKeySigningKey))) #
Generic CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Associated Types type Rep CreateKeySigningKey :: Type -> Type # Methods from :: CreateKeySigningKey -> Rep CreateKeySigningKey x # to :: Rep CreateKeySigningKey x -> CreateKeySigningKey #
Read CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods readsPrec :: Int -> ReadS CreateKeySigningKey # readList :: ReadS [CreateKeySigningKey] # readPrec :: ReadPrec CreateKeySigningKey # readListPrec :: ReadPrec [CreateKeySigningKey] #
Show CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods showsPrec :: Int -> CreateKeySigningKey -> ShowS # show :: CreateKeySigningKey -> String # showList :: [CreateKeySigningKey] -> ShowS #
NFData CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods rnf :: CreateKeySigningKey -> () #
Eq CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods (==) :: CreateKeySigningKey -> CreateKeySigningKey -> Bool # (/=) :: CreateKeySigningKey -> CreateKeySigningKey -> Bool #
Hashable CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods hashWithSalt :: Int -> CreateKeySigningKey -> Int # hash :: CreateKeySigningKey -> Int #
type AWSResponse CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey type AWSResponse CreateKeySigningKey = CreateKeySigningKeyResponse
type Rep CreateKeySigningKey Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey type Rep CreateKeySigningKey = D1 ('MetaData "CreateKeySigningKey" "Amazonka.Route53.CreateKeySigningKey" "amazonka-route53-2.0-8wP357MyuPX6rh87d4wklb" 'False) (C1 ('MetaCons "CreateKeySigningKey'" 'PrefixI 'True) ((S1 ('MetaSel ('Just "callerReference") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :: S1 ('MetaSel ('Just "hostedZoneId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 ResourceId)) :: (S1 ('MetaSel ('Just "keyManagementServiceArn") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :: (S1 ('MetaSel ('Just "name") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :: S1 ('MetaSel ('Just "status") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text)))))

newCreateKeySigningKey Source #

Arguments

:: Text	`CreateKeySigningKey`
-> ResourceId	`CreateKeySigningKey`
-> Text	`$sel:keyManagementServiceArn:CreateKeySigningKey'`
-> Text	`CreateKeySigningKey`
-> Text	`CreateKeySigningKey`
-> CreateKeySigningKey

Create a value of CreateKeySigningKey with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

CreateKeySigningKey, createKeySigningKey_callerReference - A unique string that identifies the request.

CreateKeySigningKey, createKeySigningKey_hostedZoneId - The unique string (ID) used to identify a hosted zone.

$sel:keyManagementServiceArn:CreateKeySigningKey', createKeySigningKey_keyManagementServiceArn - The Amazon resource name (ARN) for a customer managed key in Key Management Service (KMS). The KeyManagementServiceArn must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of KeyManagementServiceArn that grants the correct permissions for DNSSEC, scroll down to Example.

You must configure the customer managed customer managed key as follows:

Status

Enabled

Key spec

ECC_NIST_P256

Key usage

Sign and verify

Key policy

The key policy must give permission for the following actions:

DescribeKey
GetPublicKey
Sign

The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:

"Service": "dnssec-route53.amazonaws.com"

For more information about working with a customer managed key in KMS, see Key Management Service concepts.

CreateKeySigningKey, createKeySigningKey_name - A string used to identify a key-signing key (KSK). Name can include numbers, letters, and underscores (_). Name must be unique for each key-signing key in the same hosted zone.

CreateKeySigningKey, createKeySigningKey_status - A string specifying the initial status of the key-signing key (KSK). You can set the value to ACTIVE or INACTIVE.

Request Lenses

createKeySigningKey_callerReference :: Lens' CreateKeySigningKey Text Source #

A unique string that identifies the request.

createKeySigningKey_hostedZoneId :: Lens' CreateKeySigningKey ResourceId Source #

The unique string (ID) used to identify a hosted zone.

createKeySigningKey_keyManagementServiceArn :: Lens' CreateKeySigningKey Text Source #

The Amazon resource name (ARN) for a customer managed key in Key Management Service (KMS). The KeyManagementServiceArn must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of KeyManagementServiceArn that grants the correct permissions for DNSSEC, scroll down to Example.

You must configure the customer managed customer managed key as follows:

Status

Enabled

Key spec

ECC_NIST_P256

Key usage

Sign and verify

Key policy

The key policy must give permission for the following actions:

DescribeKey
GetPublicKey
Sign

The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:

"Service": "dnssec-route53.amazonaws.com"

For more information about working with a customer managed key in KMS, see Key Management Service concepts.

createKeySigningKey_name :: Lens' CreateKeySigningKey Text Source #

A string used to identify a key-signing key (KSK). Name can include numbers, letters, and underscores (_). Name must be unique for each key-signing key in the same hosted zone.

createKeySigningKey_status :: Lens' CreateKeySigningKey Text Source #

A string specifying the initial status of the key-signing key (KSK). You can set the value to ACTIVE or INACTIVE.

Destructuring the Response

data CreateKeySigningKeyResponse Source #

See: newCreateKeySigningKeyResponse smart constructor.

Constructors

CreateKeySigningKeyResponse'
Fields httpStatus :: Int The response's http status code. changeInfo :: ChangeInfo keySigningKey :: KeySigningKey The key-signing key (KSK) that the request creates. location :: Text The unique URL representing the new key-signing key (KSK).

Instances

Instances details

Generic CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Associated Types type Rep CreateKeySigningKeyResponse :: Type -> Type # Methods from :: CreateKeySigningKeyResponse -> Rep CreateKeySigningKeyResponse x # to :: Rep CreateKeySigningKeyResponse x -> CreateKeySigningKeyResponse #
Read CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods readsPrec :: Int -> ReadS CreateKeySigningKeyResponse # readList :: ReadS [CreateKeySigningKeyResponse] # readPrec :: ReadPrec CreateKeySigningKeyResponse # readListPrec :: ReadPrec [CreateKeySigningKeyResponse] #
Show CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods showsPrec :: Int -> CreateKeySigningKeyResponse -> ShowS # show :: CreateKeySigningKeyResponse -> String # showList :: [CreateKeySigningKeyResponse] -> ShowS #
NFData CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods rnf :: CreateKeySigningKeyResponse -> () #
Eq CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey Methods (==) :: CreateKeySigningKeyResponse -> CreateKeySigningKeyResponse -> Bool # (/=) :: CreateKeySigningKeyResponse -> CreateKeySigningKeyResponse -> Bool #
type Rep CreateKeySigningKeyResponse Source #
Instance details Defined in Amazonka.Route53.CreateKeySigningKey type Rep CreateKeySigningKeyResponse = D1 ('MetaData "CreateKeySigningKeyResponse" "Amazonka.Route53.CreateKeySigningKey" "amazonka-route53-2.0-8wP357MyuPX6rh87d4wklb" 'False) (C1 ('MetaCons "CreateKeySigningKeyResponse'" 'PrefixI 'True) ((S1 ('MetaSel ('Just "httpStatus") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Int) :: S1 ('MetaSel ('Just "changeInfo") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 ChangeInfo)) :: (S1 ('MetaSel ('Just "keySigningKey") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 KeySigningKey) :*: S1 ('MetaSel ('Just "location") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text))))

newCreateKeySigningKeyResponse Source #

Arguments

:: Int	`$sel:httpStatus:CreateKeySigningKeyResponse'`
-> ChangeInfo	`$sel:changeInfo:CreateKeySigningKeyResponse'`
-> KeySigningKey	`$sel:keySigningKey:CreateKeySigningKeyResponse'`
-> Text	`$sel:location:CreateKeySigningKeyResponse'`
-> CreateKeySigningKeyResponse

Create a value of CreateKeySigningKeyResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:httpStatus:CreateKeySigningKeyResponse', createKeySigningKeyResponse_httpStatus - The response's http status code.

$sel:changeInfo:CreateKeySigningKeyResponse', createKeySigningKeyResponse_changeInfo - Undocumented member.

$sel:keySigningKey:CreateKeySigningKeyResponse', createKeySigningKeyResponse_keySigningKey - The key-signing key (KSK) that the request creates.

$sel:location:CreateKeySigningKeyResponse', createKeySigningKeyResponse_location - The unique URL representing the new key-signing key (KSK).

Response Lenses

createKeySigningKeyResponse_httpStatus :: Lens' CreateKeySigningKeyResponse Int Source #

The response's http status code.

createKeySigningKeyResponse_changeInfo :: Lens' CreateKeySigningKeyResponse ChangeInfo Source #

Undocumented member.

createKeySigningKeyResponse_keySigningKey :: Lens' CreateKeySigningKeyResponse KeySigningKey Source #

The key-signing key (KSK) that the request creates.

createKeySigningKeyResponse_location :: Lens' CreateKeySigningKeyResponse Text Source #

The unique URL representing the new key-signing key (KSK).