create_key_signing_key async ¶

async def create_key_signing_key(
    self,
    caller_reference: "capo_route_53.types.nonce.Nonce",
    hosted_zone_id: "capo_route_53.types.resource_id.ResourceId",
    key_management_service_arn: "capo_route_53.types.signing_key_string.SigningKeyString",
    name: "capo_route_53.types.signing_key_name.SigningKeyName",
    status: "capo_route_53.types.signing_key_status.SigningKeyStatus",
    *,
    config_overrides: Optional[AsyncRoute53ClientConfig] = None,
) -> "capo_route_53.types.create_key_signing_key_response.CreateKeySigningKeyResponse":
    """<p>Creates a new key-signing key (KSK) associated with a hosted zone. You can only have two KSKs per hosted zone.</p>

    Args:
        caller_reference: <p>A unique string that identifies the request.</p>
        hosted_zone_id: <p>The unique string (ID) used to identify a hosted zone.</p>
        key_management_service_arn: <p>The Amazon resource name (ARN) for a customer managed key in Key Management Service (KMS). The <code>KeyManagementServiceArn</code> must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of <code>KeyManagementServiceArn</code> that grants the correct permissions for DNSSEC, scroll down to <b>Example</b>. </p> <p>You must configure the customer managed customer managed key as follows:</p> <dl> <dt>Status</dt> <dd> <p>Enabled</p> </dd> <dt>Key spec</dt> <dd> <p>ECC_NIST_P256</p> </dd> <dt>Key usage</dt> <dd> <p>Sign and verify</p> </dd> <dt>Key policy</dt> <dd> <p>The key policy must give permission for the following actions:</p> <ul> <li> <p>DescribeKey</p> </li> <li> <p>GetPublicKey</p> </li> <li> <p>Sign</p> </li> </ul> <p>The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:</p> <ul> <li> <p> <code>"Service": "dnssec-route53.amazonaws.com"</code> </p> </li> </ul> </dd> </dl> <p>For more information about working with a customer managed key in KMS, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html">Key Management Service concepts</a>.</p>
        name: <p>A string used to identify a key-signing key (KSK). <code>Name</code> can include numbers, letters, and underscores (_). <code>Name</code> must be unique for each key-signing key in the same hosted zone.</p>
        status: <p>A string specifying the initial status of the key-signing key (KSK). You can set the value to <code>ACTIVE</code> or <code>INACTIVE</code>.</p>

    Raises:
        capo_route_53.errors.concurrent_modification.ConcurrentModification: <p>Another user submitted a request to create, update, or delete the object at the same time that you did. Retry the request. </p>
        capo_route_53.errors.invalid_argument.InvalidArgument: <p>Parameter name is not valid.</p>
        capo_route_53.errors.invalid_input.InvalidInput: <p>The input is not valid.</p>
        capo_route_53.errors.invalid_key_signing_key_name.InvalidKeySigningKeyName: <p>The key-signing key (KSK) name that you specified isn't a valid name.</p>
        capo_route_53.errors.invalid_key_signing_key_status.InvalidKeySigningKeyStatus: <p>The key-signing key (KSK) status isn't valid or another KSK has the status <code>INTERNAL_FAILURE</code>.</p>
        capo_route_53.errors.invalid_kms_arn.InvalidKMSArn: <p>The KeyManagementServiceArn that you specified isn't valid to use with DNSSEC signing.</p>
        capo_route_53.errors.invalid_signing_status.InvalidSigningStatus: <p>Your hosted zone status isn't valid for this operation. In the hosted zone, change the status to enable <code>DNSSEC</code> or disable <code>DNSSEC</code>.</p>
        capo_route_53.errors.key_signing_key_already_exists.KeySigningKeyAlreadyExists: <p>You've already created a key-signing key (KSK) with this name or with the same customer managed key ARN.</p>
        capo_route_53.errors.no_such_hosted_zone.NoSuchHostedZone: <p>No hosted zone exists with the ID that you specified.</p>
        capo_route_53.errors.too_many_key_signing_keys.TooManyKeySigningKeys: <p>You've reached the limit for the number of key-signing keys (KSKs). Remove at least one KSK, and then try again.</p>
        capo_route_53.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    async def _handler(
        req: "AsyncOperationRequest[capo_route_53.types.create_key_signing_key_request.CreateKeySigningKeyRequest]",
    ) -> AsyncOperationResponse[
        "capo_route_53.types.create_key_signing_key_response.CreateKeySigningKeyResponse"
    ]:
        import capo_route_53._operations.aws_dns_v20130401.create_key_signing_key

        (
            output,
            http_response,
        ) = await capo_route_53._operations.aws_dns_v20130401.create_key_signing_key.async_create_key_signing_key(
            req.options, req.input
        )
        return AsyncOperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreateKeySigningKey")
    )
    input_: capo_route_53.types.create_key_signing_key_request.CreateKeySigningKeyRequest = {
        "caller_reference": caller_reference,
        "hosted_zone_id": hosted_zone_id,
        "key_management_service_arn": key_management_service_arn,
        "name": name,
        "status": status,
    }

    response = await aexecute_pipeline(
        AsyncOperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    await response.response.aclose()
    return response.output