import { AccessLevelList } from '../shared/access-level' ; import { PolicyStatement , Operator } from '../shared' ; param sid export class Kms extends PolicyStatement { public servicePrefix = 'kms' ; param sid constructor ( sid ? ) { super ( sid ) ; } /**
     * Controls permission to cancel the scheduled deletion of an AWS KMS key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html
     */ public toCancelKeyDeletion ( ) { return this . to ( 'CancelKeyDeletion' ) ; } /**
     * Controls permission to connect or reconnect a custom key store to its associated AWS CloudHSM cluster
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ConnectCustomKeyStore.html
     */ public toConnectCustomKeyStore ( ) { return this . to ( 'ConnectCustomKeyStore' ) ; } /**
     * Controls permission to create an alias for an AWS KMS key. Aliases are optional friendly names that you can associate with KMS keys
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html
     */ public toCreateAlias ( ) { return this . to ( 'CreateAlias' ) ; } /**
     * Controls permission to create a custom key store that is associated with an AWS CloudHSM cluster that you own and manage
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     *
     * Dependent actions:
     * - cloudhsm:DescribeClusters
     * - iam:CreateServiceLinkedRole
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateCustomKeyStore.html
     */ public toCreateCustomKeyStore ( ) { return this . to ( 'CreateCustomKeyStore' ) ; } /**
     * Controls permission to add a grant to an AWS KMS key. You can use grants to add permissions without changing the key policy or IAM policy
     *
     * Access Level: Permissions management
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifGrantConstraintType()
     * - .ifGrantIsForAWSResource()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html
     */ public toCreateGrant ( ) { return this . to ( 'CreateGrant' ) ; } /**
     * Controls permission to create an AWS KMS key that can be used to protect data keys and other sensitive information
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifBypassPolicyLockoutSafetyCheck()
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * Dependent actions:
     * - iam:CreateServiceLinkedRole
     * - kms:PutKeyPolicy
     * - kms:TagResource
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html
     */ public toCreateKey ( ) { return this . to ( 'CreateKey' ) ; } /**
     * Controls permission to decrypt ciphertext that was encrypted under an AWS KMS key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifEncryptionAlgorithm()
     * - .ifEncryptionContext()
     * - .ifEncryptionContextKeys()
     * - .ifRecipientAttestation()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html
     */ public toDecrypt ( ) { return this . to ( 'Decrypt' ) ; } /**
     * Controls permission to delete an alias. Aliases are optional friendly names that you can associate with AWS KMS keys
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html
     */ public toDeleteAlias ( ) { return this . to ( 'DeleteAlias' ) ; } /**
     * Controls permission to delete a custom key store
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteCustomKeyStore.html
     */ public toDeleteCustomKeyStore ( ) { return this . to ( 'DeleteCustomKeyStore' ) ; } /**
     * Controls permission to delete cryptographic material that you imported into an AWS KMS key. This action makes the key unusable
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html
     */ public toDeleteImportedKeyMaterial ( ) { return this . to ( 'DeleteImportedKeyMaterial' ) ; } /**
     * Controls permission to view detailed information about custom key stores in the account and region
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifCallerAccount()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeCustomKeyStores.html
     */ public toDescribeCustomKeyStores ( ) { return this . to ( 'DescribeCustomKeyStores' ) ; } /**
     * Controls permission to view detailed information about an AWS KMS key
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html
     */ public toDescribeKey ( ) { return this . to ( 'DescribeKey' ) ; } /**
     * Controls permission to disable an AWS KMS key, which prevents it from being used in cryptographic operations
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html
     */ public toDisableKey ( ) { return this . to ( 'DisableKey' ) ; } /**
     * Controls permission to disable automatic rotation of a customer managed AWS KMS key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html
     */ public toDisableKeyRotation ( ) { return this . to ( 'DisableKeyRotation' ) ; } /**
     * Controls permission to disconnect the custom key store from its associated AWS CloudHSM cluster
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_DisconnectCustomKeyStore.html
     */ public toDisconnectCustomKeyStore ( ) { return this . to ( 'DisconnectCustomKeyStore' ) ; } /**
     * Controls permission to change the state of an AWS KMS key to enabled. This allows the KMS key to be used in cryptographic operations
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html
     */ public toEnableKey ( ) { return this . to ( 'EnableKey' ) ; } /**
     * Controls permission to enable automatic rotation of the cryptographic material in an AWS KMS key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html
     */ public toEnableKeyRotation ( ) { return this . to ( 'EnableKeyRotation' ) ; } /**
     * Controls permission to use the specified AWS KMS key to encrypt data and data keys
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifEncryptionAlgorithm()
     * - .ifEncryptionContext()
     * - .ifEncryptionContextKeys()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html
     */ public toEncrypt ( ) { return this . to ( 'Encrypt' ) ; } /**
     * Controls permission to use the AWS KMS key to generate data keys. You can use the data keys to encrypt data outside of AWS KMS
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifEncryptionAlgorithm()
     * - .ifEncryptionContext()
     * - .ifEncryptionContextKeys()
     * - .ifRecipientAttestation()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html
     */ public toGenerateDataKey ( ) { return this . to ( 'GenerateDataKey' ) ; } /**
     * Controls permission to use the AWS KMS key to generate data key pairs
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifDataKeyPairSpec()
     * - .ifEncryptionAlgorithm()
     * - .ifEncryptionContext()
     * - .ifEncryptionContextKeys()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html
     */ public toGenerateDataKeyPair ( ) { return this . to ( 'GenerateDataKeyPair' ) ; } /**
     * Controls permission to use the AWS KMS key to generate data key pairs. Unlike the GenerateDataKeyPair operation, this operation returns an encrypted private key without a plaintext copy
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifDataKeyPairSpec()
     * - .ifEncryptionAlgorithm()
     * - .ifEncryptionContext()
     * - .ifEncryptionContextKeys()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html
     */ public toGenerateDataKeyPairWithoutPlaintext ( ) { return this . to ( 'GenerateDataKeyPairWithoutPlaintext' ) ; } /**
     * Controls permission to use the AWS KMS key to generate a data key. Unlike the GenerateDataKey operation, this operation returns an encrypted data key without a plaintext version of the data key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifEncryptionAlgorithm()
     * - .ifEncryptionContext()
     * - .ifEncryptionContextKeys()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html
     */ public toGenerateDataKeyWithoutPlaintext ( ) { return this . to ( 'GenerateDataKeyWithoutPlaintext' ) ; } /**
     * Controls permission to get a cryptographically secure random byte string from AWS KMS
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifRecipientAttestation()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateRandom.html
     */ public toGenerateRandom ( ) { return this . to ( 'GenerateRandom' ) ; } /**
     * Controls permission to view the key policy for the specified AWS KMS key
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html
     */ public toGetKeyPolicy ( ) { return this . to ( 'GetKeyPolicy' ) ; } /**
     * Controls permission to determine whether automatic key rotation is enabled on the AWS KMS key
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html
     */ public toGetKeyRotationStatus ( ) { return this . to ( 'GetKeyRotationStatus' ) ; } /**
     * Controls permission to get data that is required to import cryptographic material into a customer managed key, including a public key and import token
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     * - .ifWrappingAlgorithm()
     * - .ifWrappingKeySpec()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html
     */ public toGetParametersForImport ( ) { return this . to ( 'GetParametersForImport' ) ; } /**
     * Controls permission to download the public key of an asymmetric AWS KMS key
     *
     * Access Level: Read
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html
     */ public toGetPublicKey ( ) { return this . to ( 'GetPublicKey' ) ; } /**
     * Controls permission to import cryptographic material into an AWS KMS key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifExpirationModel()
     * - .ifValidTo()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html
     */ public toImportKeyMaterial ( ) { return this . to ( 'ImportKeyMaterial' ) ; } /**
     * Controls permission to view the aliases that are defined in the account. Aliases are optional friendly names that you can associate with AWS KMS keys
     *
     * Access Level: List
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html
     */ public toListAliases ( ) { return this . to ( 'ListAliases' ) ; } /**
     * Controls permission to view all grants for an AWS KMS key
     *
     * Access Level: List
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifGrantIsForAWSResource()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html
     */ public toListGrants ( ) { return this . to ( 'ListGrants' ) ; } /**
     * Controls permission to view the names of key policies for an AWS KMS key
     *
     * Access Level: List
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html
     */ public toListKeyPolicies ( ) { return this . to ( 'ListKeyPolicies' ) ; } /**
     * Controls permission to view the key ID and Amazon Resource Name (ARN) of all AWS KMS keys in the account
     *
     * Access Level: List
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeys.html
     */ public toListKeys ( ) { return this . to ( 'ListKeys' ) ; } /**
     * Controls permission to view all tags that are attached to an AWS KMS key
     *
     * Access Level: List
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html
     */ public toListResourceTags ( ) { return this . to ( 'ListResourceTags' ) ; } /**
     * Controls permission to view grants in which the specified principal is the retiring principal. Other principals might be able to retire the grant and this principal might be able to retire other grants
     *
     * Access Level: List
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html
     */ public toListRetirableGrants ( ) { return this . to ( 'ListRetirableGrants' ) ; } /**
     * Controls permission to replace the key policy for the specified AWS KMS key
     *
     * Access Level: Permissions management
     *
     * Possible conditions:
     * - .ifBypassPolicyLockoutSafetyCheck()
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html
     */ public toPutKeyPolicy ( ) { return this . to ( 'PutKeyPolicy' ) ; } /**
     * Controls permission to decrypt data as part of the process that decrypts and reencrypts the data within AWS KMS
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifEncryptionAlgorithm()
     * - .ifEncryptionContext()
     * - .ifEncryptionContextKeys()
     * - .ifReEncryptOnSameKey()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html
     */ public toReEncryptFrom ( ) { return this . to ( 'ReEncryptFrom' ) ; } /**
     * Controls permission to encrypt data as part of the process that decrypts and reencrypts the data within AWS KMS
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifEncryptionAlgorithm()
     * - .ifEncryptionContext()
     * - .ifEncryptionContextKeys()
     * - .ifReEncryptOnSameKey()
     * - .ifRequestAlias()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html
     */ public toReEncryptTo ( ) { return this . to ( 'ReEncryptTo' ) ; } /**
     * Controls permission to replicate a multi-Region primary key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifReplicaRegion()
     * - .ifViaService()
     *
     * Dependent actions:
     * - iam:CreateServiceLinkedRole
     * - kms:CreateKey
     * - kms:PutKeyPolicy
     * - kms:TagResource
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html
     */ public toReplicateKey ( ) { return this . to ( 'ReplicateKey' ) ; } /**
     * Controls permission to retire a grant. The RetireGrant operation is typically called by the grant user after they complete the tasks that the grant allowed them to perform
     *
     * Access Level: Permissions management
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html
     */ public toRetireGrant ( ) { return this . to ( 'RetireGrant' ) ; } /**
     * Controls permission to revoke a grant, which denies permission for all operations that depend on the grant
     *
     * Access Level: Permissions management
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifGrantIsForAWSResource()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html
     */ public toRevokeGrant ( ) { return this . to ( 'RevokeGrant' ) ; } /**
     * Controls permission to schedule deletion of an AWS KMS key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html
     */ public toScheduleKeyDeletion ( ) { return this . to ( 'ScheduleKeyDeletion' ) ; } /**
     * Controls permission to produce a digital signature for a message
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifMessageType()
     * - .ifRequestAlias()
     * - .ifSigningAlgorithm()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html
     */ public toSign ( ) { return this . to ( 'Sign' ) ; } /**
     * Controls access to internal APIs that synchronize multi-Region keys
     *
     * Access Level: Write
     *
     * https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-auth.html#multi-region-auth-slr
     */ public toSynchronizeMultiRegionKey ( ) { return this . to ( 'SynchronizeMultiRegionKey' ) ; } /**
     * Controls permission to create or update tags that are attached to an AWS KMS key
     *
     * Access Level: Tagging
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html
     */ public toTagResource ( ) { return this . to ( 'TagResource' ) ; } /**
     * Controls permission to delete tags that are attached to an AWS KMS key
     *
     * Access Level: Tagging
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html
     */ public toUntagResource ( ) { return this . to ( 'UntagResource' ) ; } /**
     * Controls permission to associate an alias with a different AWS KMS key. An alias is an optional friendly name that you can associate with a KMS key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html
     */ public toUpdateAlias ( ) { return this . to ( 'UpdateAlias' ) ; } /**
     * Controls permission to change the properties of a custom key store
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateCustomKeyStore.html
     */ public toUpdateCustomKeyStore ( ) { return this . to ( 'UpdateCustomKeyStore' ) ; } /**
     * Controls permission to delete or change the description of an AWS KMS key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html
     */ public toUpdateKeyDescription ( ) { return this . to ( 'UpdateKeyDescription' ) ; } /**
     * Controls permission to update the primary Region of a multi-Region primary key
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifPrimaryRegion()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdatePrimaryRegion.html
     */ public toUpdatePrimaryRegion ( ) { return this . to ( 'UpdatePrimaryRegion' ) ; } /**
     * Controls permission to use the specified AWS KMS key to verify digital signatures
     *
     * Access Level: Write
     *
     * Possible conditions:
     * - .ifCallerAccount()
     * - .ifMessageType()
     * - .ifRequestAlias()
     * - .ifSigningAlgorithm()
     * - .ifViaService()
     *
     * https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html
     */ public toVerify ( ) { return this . to ( 'Verify' ) ; } protected accessLevelList : AccessLevelList = { Write : [ 'CancelKeyDeletion' , 'ConnectCustomKeyStore' , 'CreateAlias' , 'CreateCustomKeyStore' , 'CreateKey' , 'Decrypt' , 'DeleteAlias' , 'DeleteCustomKeyStore' , 'DeleteImportedKeyMaterial' , 'DisableKey' , 'DisableKeyRotation' , 'DisconnectCustomKeyStore' , 'EnableKey' , 'EnableKeyRotation' , 'Encrypt' , 'GenerateDataKey' , 'GenerateDataKeyPair' , 'GenerateDataKeyPairWithoutPlaintext' , 'GenerateDataKeyWithoutPlaintext' , 'GenerateRandom' , 'ImportKeyMaterial' , 'ReEncryptFrom' , 'ReEncryptTo' , 'ReplicateKey' , 'ScheduleKeyDeletion' , 'Sign' , 'SynchronizeMultiRegionKey' , 'UpdateAlias' , 'UpdateCustomKeyStore' , 'UpdateKeyDescription' , 'UpdatePrimaryRegion' , 'Verify' ] , 'Permissions management' : [ 'CreateGrant' , 'PutKeyPolicy' , 'RetireGrant' , 'RevokeGrant' ] , Read : [ 'DescribeCustomKeyStores' , 'DescribeKey' , 'GetKeyPolicy' , 'GetKeyRotationStatus' , 'GetParametersForImport' , 'GetPublicKey' ] , List : [ 'ListAliases' , 'ListGrants' , 'ListKeyPolicies' , 'ListKeys' , 'ListResourceTags' , 'ListRetirableGrants' ] , Tagging : [ 'TagResource' , 'UntagResource' ] } ; param alias param account param region param partition public onAlias ( alias , account ? , region ? , partition ? ) { return this . on ( `arn:${ partition || 'aws' }:kms:${ region || '*' }:${ account || '*' }:alias/${ alias }` ) ; } param keyId param account param region param partition public onKey ( keyId , account ? , region ? , partition ? ) { return this . on ( `arn:${ partition || 'aws' }:kms:${ region || '*' }:${ account || '*' }:key/${ keyId }` ) ; } param value public ifBypassPolicyLockoutSafetyCheck ( value ? ) { return this . if ( `BypassPolicyLockoutSafetyCheck` , ( typeof value !== 'undefined' ? value : true ) , 'Bool' ) ; } param value param operator public ifCallerAccount ( value , operator ? ) { return this . if ( `CallerAccount` , value , operator || 'StringLike' ) ; } param value param operator public ifCustomerMasterKeySpec ( value , operator ? ) { return this . if ( `CustomerMasterKeySpec` , value , operator || 'StringLike' ) ; } param value param operator public ifCustomerMasterKeyUsage ( value , operator ? ) { return this . if ( `CustomerMasterKeyUsage` , value , operator || 'StringLike' ) ; } param value param operator public ifDataKeyPairSpec ( value , operator ? ) { return this . if ( `DataKeyPairSpec` , value , operator || 'StringLike' ) ; } param value param operator public ifEncryptionAlgorithm ( value , operator ? ) { return this . if ( `EncryptionAlgorithm` , value , operator || 'StringLike' ) ; } param value param operator public ifEncryptionContext ( value , operator ? ) { return this . if ( `EncryptionContext` , value , operator || 'StringLike' ) ; } param value param operator public ifEncryptionContextKeys ( value , operator ? ) { return this . if ( `EncryptionContextKeys` , value , operator || 'StringLike' ) ; } param value param operator public ifExpirationModel ( value , operator ? ) { return this . if ( `ExpirationModel` , value , operator || 'StringLike' ) ; } param value param operator public ifGrantConstraintType ( value , operator ? ) { return this . if ( `GrantConstraintType` , value , operator || 'StringLike' ) ; } param value public ifGrantIsForAWSResource ( value ? ) { return this . if ( `GrantIsForAWSResource` , ( typeof value !== 'undefined' ? value : true ) , 'Bool' ) ; } param value param operator public ifGrantOperations ( value , operator ? ) { return this . if ( `GrantOperations` , value , operator || 'StringLike' ) ; } param value param operator public ifGranteePrincipal ( value , operator ? ) { return this . if ( `GranteePrincipal` , value , operator || 'StringLike' ) ; } param value param operator public ifKeyOrigin ( value , operator ? ) { return this . if ( `KeyOrigin` , value , operator || 'StringLike' ) ; } param value param operator public ifKeySpec ( value , operator ? ) { return this . if ( `KeySpec` , value , operator || 'StringLike' ) ; } param value param operator public ifKeyUsage ( value , operator ? ) { return this . if ( `KeyUsage` , value , operator || 'StringLike' ) ; } param value param operator public ifMessageType ( value , operator ? ) { return this . if ( `MessageType` , value , operator || 'StringLike' ) ; } param value public ifMultiRegion ( value ? ) { return this . if ( `MultiRegion` , ( typeof value !== 'undefined' ? value : true ) , 'Bool' ) ; } param value param operator public ifMultiRegionKeyType ( value , operator ? ) { return this . if ( `MultiRegionKeyType` , value , operator || 'StringLike' ) ; } param value param operator public ifPrimaryRegion ( value , operator ? ) { return this . if ( `PrimaryRegion` , value , operator || 'StringLike' ) ; } param value public ifReEncryptOnSameKey ( value ? ) { return this . if ( `ReEncryptOnSameKey` , ( typeof value !== 'undefined' ? value : true ) , 'Bool' ) ; } param value param operator public ifRecipientAttestation ( value , operator ? ) { return this . if ( `RecipientAttestation` , value , operator || 'StringLike' ) ; } param value param operator public ifReplicaRegion ( value , operator ? ) { return this . if ( `ReplicaRegion` , value , operator || 'StringLike' ) ; } param value param operator public ifRequestAlias ( value , operator ? ) { return this . if ( `RequestAlias` , value , operator || 'StringLike' ) ; } param value param operator public ifResourceAliases ( value , operator ? ) { return this . if ( `ResourceAliases` , value , operator || 'StringLike' ) ; } param value param operator public ifRetiringPrincipal ( value , operator ? ) { return this . if ( `RetiringPrincipal` , value , operator || 'StringLike' ) ; } param value param operator public ifSigningAlgorithm ( value , operator ? ) { return this . if ( `SigningAlgorithm` , value , operator || 'StringLike' ) ; } param value param operator public ifValidTo ( value , operator ? ) { if ( typeof ( value as Date ) . getMonth === "function" ) { value = ( value as Date ) . toISOString ( ) ; } else if ( Array . isArray ( value ) ) { value = value . map ( ( item ) => { if ( typeof ( item as Date ) . getMonth === "function" ) { item = ( item as Date ) . toISOString ( ) ; } return item ; } ) ; } return this . if ( `ValidTo` , value , operator || 'DateEquals' ) ; } param value param operator public ifViaService ( value , operator ? ) { return this . if ( `ViaService` , value , operator || 'StringLike' ) ; } param value param operator public ifWrappingAlgorithm ( value , operator ? ) { return this . if ( `WrappingAlgorithm` , value , operator || 'StringLike' ) ; } param value param operator public ifWrappingKeySpec ( value , operator ? ) { return this . if ( `WrappingKeySpec` , value , operator || 'StringLike' ) ; } }