re_encrypt_data ¶

def re_encrypt_data(
    self,
    incoming_key_identifier: "capo_payment_cryptography_data.types.key_arn_or_key_alias_type.KeyArnOrKeyAliasType",
    outgoing_key_identifier: "capo_payment_cryptography_data.types.key_arn_or_key_alias_type.KeyArnOrKeyAliasType",
    cipher_text: "capo_payment_cryptography_data.types.cipher_text_type.CipherTextType",
    incoming_encryption_attributes: "capo_payment_cryptography_data.types.re_encryption_attributes.ReEncryptionAttributes",
    outgoing_encryption_attributes: "capo_payment_cryptography_data.types.re_encryption_attributes.ReEncryptionAttributes",
    *,
    config_overrides: Optional[PaymentCryptographyDataClientConfig] = None,
    incoming_wrapped_key: Optional[
        "capo_payment_cryptography_data.types.wrapped_key.WrappedKey"
    ] = None,
    outgoing_wrapped_key: Optional[
        "capo_payment_cryptography_data.types.wrapped_key.WrappedKey"
    ] = None,
) -> "capo_payment_cryptography_data.types.re_encrypt_data_output.ReEncryptDataOutput":
    """<p>Re-encrypts ciphertext using DUKPT, symmetric, or asymmetric data encryption keys. </p> <p>You can either generate an encryption key within Amazon Web Services Payment Cryptography by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html">CreateKey</a> or import your own encryption key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. The <code>KeyArn</code> for use with this operation must be in a compatible key state with <code>KeyModesOfUse</code> set to <code>Encrypt</code>. </p> <p>This operation also supports dynamic keys, allowing you to pass a dynamic encryption key as a TR-31 WrappedKeyBlock. This can be used when key material is frequently rotated, such as during every card transaction, and there is need to avoid importing short-lived keys into Amazon Web Services Payment Cryptography. To re-encrypt using dynamic keys, the <code>keyARN</code> is the Key Encryption Key (KEK) of the TR-31 wrapped encryption key material. The incoming wrapped key shall have a key purpose of D0 with a mode of use of B or D. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-acquirers-dynamickeys.html">Using Dynamic Keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>Amazon Web Services Payment Cryptography supports the following encryption key schemes:</p> <ul> <li> <p> <b>DUKPT</b>: <code>TDES</code> and <code>AES</code> algorithms. To encrypt using DUKPT, a DUKPT key must already exist within your account with <code>KeyModesOfUse</code> set to <code>DeriveKey</code> or a new DUKPT can be generated by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html">CreateKey</a>.</p> </li> <li> <p> <b>Symmetric</b>: <code>TDES</code> and <code>AES</code> algorithms.</p> </li> <li> <p> <b>Asymmetric</b>: <code>RSA</code>. You can use an <code>RSA</code> key on either the incoming or the outgoing side, paired with a symmetric key on the other side.</p> </li> </ul> <p>For information about valid keys for this operation, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html">Understanding key attributes</a> and <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p> <p> <b>Cross-account use</b>: This operation supports cross-account use when the key has a resource-based policy that grants access. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/security_iam_resource-based-policies.html">Resource-based policies</a>.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>DecryptData</a> </p> </li> <li> <p> <a>EncryptData</a> </p> </li> <li> <p> <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_GetPublicKeyCertificate.html">GetPublicCertificate</a> </p> </li> <li> <p> <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a> </p> </li> </ul>

    Args:
        incoming_key_identifier: <p>The <code>keyARN</code> of the encryption key of incoming ciphertext data.</p> <p>When a WrappedKeyBlock is provided, this value will be the identifier to the key wrapping key. Otherwise, it is the key identifier used to perform the operation.</p>
        outgoing_key_identifier: <p>The <code>keyARN</code> of the encryption key of outgoing ciphertext data after encryption by Amazon Web Services Payment Cryptography.</p>
        cipher_text: <p>Ciphertext to be encrypted. The minimum allowed length is 16 bytes and maximum allowed length is 4096 bytes.</p>
        incoming_encryption_attributes: <p>The attributes and values for incoming ciphertext.</p>
        outgoing_encryption_attributes: <p>The attributes and values for outgoing ciphertext data after encryption by Amazon Web Services Payment Cryptography.</p>
        incoming_wrapped_key: <p>The WrappedKeyBlock containing the encryption key of incoming ciphertext data.</p>
        outgoing_wrapped_key: <p>The WrappedKeyBlock containing the encryption key of outgoing ciphertext data after encryption by Amazon Web Services Payment Cryptography.</p>

    Raises:
        capo_payment_cryptography_data.errors.access_denied_exception.AccessDeniedException: <p>You do not have sufficient access to perform this action.</p>
        capo_payment_cryptography_data.errors.internal_server_exception.InternalServerException: <p>The request processing has failed because of an unknown error, exception, or failure.</p>
        capo_payment_cryptography_data.errors.resource_not_found_exception.ResourceNotFoundException: <p>The request was denied due to an invalid resource error.</p>
        capo_payment_cryptography_data.errors.throttling_exception.ThrottlingException: <p>The request was denied due to request throttling.</p>
        capo_payment_cryptography_data.errors.validation_exception.ValidationException: <p>The request was denied due to an invalid request error.</p>
        capo_payment_cryptography_data.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_payment_cryptography_data.types.re_encrypt_data_input.ReEncryptDataInput]",
    ) -> OperationResponse[
        "capo_payment_cryptography_data.types.re_encrypt_data_output.ReEncryptDataOutput"
    ]:
        import capo_payment_cryptography_data._operations.payment_cryptography_data_plane.re_encrypt_data

        output, http_response = (
            capo_payment_cryptography_data._operations.payment_cryptography_data_plane.re_encrypt_data.re_encrypt_data(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_payment_cryptography_data.types.re_encrypt_data_input.ReEncryptDataInput",
    ) -> dict[str, Any]:
        import capo_payment_cryptography_data.types.re_encrypt_data_input

        return capo_payment_cryptography_data.types.re_encrypt_data_input.redact_sensitive(
            input_
        )

    def _redact_output(
        output: "capo_payment_cryptography_data.types.re_encrypt_data_output.ReEncryptDataOutput",
    ) -> dict[str, Any]:
        import capo_payment_cryptography_data.types.re_encrypt_data_output

        return capo_payment_cryptography_data.types.re_encrypt_data_output.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "ReEncryptData",
            redact_input=_redact_input,
            redact_output=_redact_output,
        ),
    )
    input_: capo_payment_cryptography_data.types.re_encrypt_data_input.ReEncryptDataInput = {
        "incoming_key_identifier": incoming_key_identifier,
        "outgoing_key_identifier": outgoing_key_identifier,
        "cipher_text": cipher_text,
        "incoming_encryption_attributes": incoming_encryption_attributes,
        "outgoing_encryption_attributes": outgoing_encryption_attributes,
    }
    if incoming_wrapped_key is not None:
        input_["incoming_wrapped_key"] = incoming_wrapped_key
    if outgoing_wrapped_key is not None:
        input_["outgoing_wrapped_key"] = outgoing_wrapped_key

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output