"""
Autogenerated state module using `pop-create-idem <https://gitlab.com/saltstack/pop/pop-create-idem>`__

hub.exec.boto3.client.kms.create_key
hub.exec.boto3.client.kms.describe_key
hub.exec.boto3.client.kms.disable_key
hub.exec.boto3.client.kms.enable_key
hub.exec.boto3.client.kms.list_keys
hub.exec.boto3.client.kms.replicate_key
"""



from typing import *
import dict_tools.differ as differ
async def present(hub, ctx, name: Text, policy: Text = None, description: Text = None, key_usage: Text = None, customer_master_key_spec: Text = None, origin: Text = None, custom_key_store_id: Text = None, bypass_policy_lockout_safety_check: bool = None, tags: List = None, multi_region: bool = None)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    Creates a unique customer managed customer master key (CMK) in your AWS account and Region. You can use the
    CreateKey operation to create symmetric or asymmetric CMKs.    Symmetric CMKs contain a 256-bit symmetric key
    that never leaves AWS KMS unencrypted. To use the CMK, you must call AWS KMS. You can use a symmetric CMK to
    encrypt and decrypt small amounts of data, but they are typically used to generate data keys and data keys
    pairs. For details, see GenerateDataKey and GenerateDataKeyPair.    Asymmetric CMKs can contain an RSA key pair
    or an Elliptic Curve (ECC) key pair. The private key in an asymmetric CMK never leaves AWS KMS unencrypted.
    However, you can use the GetPublicKey operation to download the public key so it can be used outside of AWS KMS.
    CMKs with RSA key pairs can be used to encrypt or decrypt data or sign and verify messages (but not both). CMKs
    with ECC key pairs can be used only to sign and verify messages.   For information about symmetric and
    asymmetric CMKs, see Using Symmetric and Asymmetric CMKs in the AWS Key Management Service Developer Guide. To
    create different types of CMKs, use the following guidance:  Asymmetric CMKs  To create an asymmetric CMK, use
    the CustomerMasterKeySpec parameter to specify the type of key material in the CMK. Then, use the KeyUsage
    parameter to determine whether the CMK will be used to encrypt and decrypt or sign and verify. You can't change
    these properties after the CMK is created.    Symmetric CMKs  When creating a symmetric CMK, you don't need to
    specify the CustomerMasterKeySpec or KeyUsage parameters. The default value for CustomerMasterKeySpec,
    SYMMETRIC_DEFAULT, and the default value for KeyUsage, ENCRYPT_DECRYPT, are the only valid values for symmetric
    CMKs.     Multi-Region primary keys Imported key material  To create a multi-Region primary key in the local AWS
    Region, use the MultiRegion parameter with a value of True. To create a multi-Region replica key, that is, a CMK
    with the same key ID and key material as a primary key, but in a different AWS Region, use the ReplicateKey
    operation. To change a replica key to a primary key, and its primary key to a replica key, use the
    UpdatePrimaryRegion operation. This operation supports multi-Region keys, an AWS KMS feature that lets you
    create multiple interoperable CMKs in different AWS Regions. Because these CMKs have the same key ID, key
    material, and other metadata, you can use them to encrypt data in one AWS Region and decrypt it in a different
    AWS Region without making a cross-Region call or exposing the plaintext data. For more information about multi-
    Region keys, see Using multi-Region keys in the AWS Key Management Service Developer Guide. You can create
    symmetric and asymmetric multi-Region keys and multi-Region keys with imported key material. You cannot create
    multi-Region keys in a custom key store.     To import your own key material, begin by creating a symmetric CMK
    with no key material. To do this, use the Origin parameter of CreateKey with a value of EXTERNAL. Next, use
    GetParametersForImport operation to get a public key and import token, and use the public key to encrypt your
    key material. Then, use ImportKeyMaterial with your import token to import the key material. For step-by-step
    instructions, see Importing Key Material in the  AWS Key Management Service Developer Guide . You cannot import
    the key material into an asymmetric CMK. To create a multi-Region primary key with imported key material, use
    the Origin parameter of CreateKey with a value of EXTERNAL and the MultiRegion parameter with a value of True.
    To create replicas of the multi-Region primary key, use the ReplicateKey operation. For more information about
    multi-Region keys, see Using multi-Region keys in the AWS Key Management Service Developer Guide.    Custom key
    store  To create a symmetric CMK in a custom key store, use the CustomKeyStoreId parameter to specify the custom
    key store. You must also use the Origin parameter with a value of AWS_CLOUDHSM. The AWS CloudHSM cluster that is
    associated with the custom key store must have at least two active HSMs in different Availability Zones in the
    AWS Region.  You cannot create an asymmetric CMK or a multi-Region CMK in a custom key store. For information
    about custom key stores in AWS KMS see Using Custom Key Stores in the  AWS Key Management Service Developer
    Guide .    Cross-account use: No. You cannot use this operation to create a CMK in a different AWS account.
    Required permissions: kms:CreateKey (IAM policy). To use the Tags parameter, kms:TagResource (IAM policy). For
    examples and information about related permissions, see Allow a user to create CMKs in the AWS Key Management
    Service Developer Guide.  Related operations:     DescribeKey     ListKeys     ScheduleKeyDeletion

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        policy(Text, optional): The key policy to attach to the CMK. If you provide a key policy, it must meet the following
            criteria:   If you don't set BypassPolicyLockoutSafetyCheck to true, the key policy must allow
            the principal that is making the CreateKey request to make a subsequent PutKeyPolicy request on
            the CMK. This reduces the risk that the CMK becomes unmanageable. For more information, refer to
            the scenario in the Default Key Policy section of the  AWS Key Management Service Developer
            Guide .   Each statement in the key policy must contain one or more principals. The principals
            in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for
            example, an IAM user or role), you might need to enforce a delay before including the new
            principal in a key policy because the new principal might not be immediately visible to AWS KMS.
            For more information, see Changes that I make are not always immediately visible in the AWS
            Identity and Access Management User Guide.   If you do not provide a key policy, AWS KMS
            attaches a default key policy to the CMK. For more information, see Default Key Policy in the
            AWS Key Management Service Developer Guide.  The key policy size quota is 32 kilobytes (32768
            bytes). For help writing and formatting a JSON policy document, see the IAM JSON Policy
            Reference in the  IAM User Guide . Defaults to None.
        description(Text, optional): A description of the CMK. Use a description that helps you decide whether the CMK is appropriate
            for a task. The default value is an empty string (no description). Defaults to None.
        key_usage(Text, optional): Determines the cryptographic operations for which you can use the CMK. The default value is
            ENCRYPT_DECRYPT. This parameter is required only for asymmetric CMKs. You can't change the
            KeyUsage value after the CMK is created. Select only one valid value.   For symmetric CMKs, omit
            the parameter or specify ENCRYPT_DECRYPT.   For asymmetric CMKs with RSA key material, specify
            ENCRYPT_DECRYPT or SIGN_VERIFY.   For asymmetric CMKs with ECC key material, specify
            SIGN_VERIFY. Defaults to None.
        customer_master_key_spec(Text, optional): Specifies the type of CMK to create. The default value, SYMMETRIC_DEFAULT, creates a CMK with a
            256-bit symmetric key for encryption and decryption. For help choosing a key spec for your CMK,
            see How to Choose Your CMK Configuration in the AWS Key Management Service Developer Guide. The
            CustomerMasterKeySpec determines whether the CMK contains a symmetric key or an asymmetric key
            pair. It also determines the encryption algorithms or signing algorithms that the CMK supports.
            You can't change the CustomerMasterKeySpec after the CMK is created. To further restrict the
            algorithms that can be used with the CMK, use a condition key in its key policy or IAM policy.
            For more information, see kms:EncryptionAlgorithm or kms:Signing Algorithm in the AWS Key
            Management Service Developer Guide.   AWS services that are integrated with AWS KMS use
            symmetric CMKs to protect your data. These services do not support asymmetric CMKs. For help
            determining whether a CMK is symmetric or asymmetric, see Identifying Symmetric and Asymmetric
            CMKs in the AWS Key Management Service Developer Guide.  AWS KMS supports the following key
            specs for CMKs:   Symmetric key (default)    SYMMETRIC_DEFAULT (AES-256-GCM)     Asymmetric RSA
            key pairs    RSA_2048     RSA_3072     RSA_4096      Asymmetric NIST-recommended elliptic curve
            key pairs    ECC_NIST_P256 (secp256r1)    ECC_NIST_P384 (secp384r1)    ECC_NIST_P521 (secp521r1)
            Other asymmetric elliptic curve key pairs    ECC_SECG_P256K1 (secp256k1), commonly used for
            cryptocurrencies. Defaults to None.
        origin(Text, optional): The source of the key material for the CMK. You cannot change the origin after you create the
            CMK. The default is AWS_KMS, which means that AWS KMS creates the key material. To create a CMK
            with no key material (for imported key material), set the value to EXTERNAL. For more
            information about importing key material into AWS KMS, see Importing Key Material in the AWS Key
            Management Service Developer Guide. This value is valid only for symmetric CMKs. To create a CMK
            in an AWS KMS custom key store and create its key material in the associated AWS CloudHSM
            cluster, set this value to AWS_CLOUDHSM. You must also use the CustomKeyStoreId parameter to
            identify the custom key store. This value is valid only for symmetric CMKs. Defaults to None.
        custom_key_store_id(Text, optional): Creates the CMK in the specified custom key store and the key material in its associated AWS
            CloudHSM cluster. To create a CMK in a custom key store, you must also specify the Origin
            parameter with a value of AWS_CLOUDHSM. The AWS CloudHSM cluster that is associated with the
            custom key store must have at least two active HSMs, each in a different Availability Zone in
            the Region. This parameter is valid only for symmetric CMKs and regional CMKs. You cannot create
            an asymmetric CMK or a multi-Region CMK in a custom key store. To find the ID of a custom key
            store, use the DescribeCustomKeyStores operation. The response includes the custom key store ID
            and the ID of the AWS CloudHSM cluster. This operation is part of the Custom Key Store feature
            feature in AWS KMS, which combines the convenience and extensive integration of AWS KMS with the
            isolation and control of a single-tenant key store. Defaults to None.
        bypass_policy_lockout_safety_check(bool, optional): A flag to indicate whether to bypass the key policy lockout safety check.  Setting this value to
            true increases the risk that the CMK becomes unmanageable. Do not set this value to true
            indiscriminately. For more information, refer to the scenario in the Default Key Policy section
            in the  AWS Key Management Service Developer Guide .  Use this parameter only when you include a
            policy in the request and you intend to prevent the principal that is making the request from
            making a subsequent PutKeyPolicy request on the CMK. The default value is false. Defaults to None.
        tags(List, optional): Assigns one or more tags to the CMK. Use this parameter to tag the CMK when it is created. To
            tag an existing CMK, use the TagResource operation.  Tagging or untagging a CMK can allow or
            deny permission to the CMK. For details, see Using ABAC in AWS KMS in the AWS Key Management
            Service Developer Guide.  To use this parameter, you must have kms:TagResource permission in an
            IAM policy. Each tag consists of a tag key and a tag value. Both the tag key and the tag value
            are required, but the tag value can be an empty (null) string. You cannot have more than one tag
            on a CMK with the same tag key. If you specify an existing tag key with a different tag value,
            AWS KMS replaces the current tag value with the specified one. When you assign tags to an AWS
            resource, AWS generates a cost allocation report with usage and costs aggregated by tags. Tags
            can also be used to control access to a CMK. For details, see Tagging Keys. Defaults to None.
        multi_region(bool, optional): Creates a multi-Region primary key that you can replicate into other AWS Regions. You cannot
            change this value after you create the CMK.  For a multi-Region key, set this parameter to True.
            For a single-Region CMK, omit this parameter or set it to False. The default value is False.
            This operation supports multi-Region keys, an AWS KMS feature that lets you create multiple
            interoperable CMKs in different AWS Regions. Because these CMKs have the same key ID, key
            material, and other metadata, you can use them to encrypt data in one AWS Region and decrypt it
            in a different AWS Region without making a cross-Region call or exposing the plaintext data. For
            more information about multi-Region keys, see Using multi-Region keys in the AWS Key Management
            Service Developer Guide. This value creates a primary key, not a replica. To create a replica
            key, use the ReplicateKey operation.  You can create a symmetric or asymmetric multi-Region CMK,
            and you can create a multi-Region CMK with imported key material. However, you cannot create a
            multi-Region CMK in a custom key store. Defaults to None.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_present:
              aws_auto.kms.key.present:
                - name: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.kms.key.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    
    before = await hub.exec.boto3.client.kms.describe_key(name)

    if before:
        result["comment"] = f"'{name}' already exists"
    else:
        try:
            ret = await hub.exec.boto3.client.kms.create_key(
                ctx,
                
                
                **{"Policy": policy, "Description": description, "KeyUsage": key_usage, "CustomerMasterKeySpec": customer_master_key_spec, "Origin": origin, "CustomKeyStoreId": custom_key_store_id, "BypassPolicyLockoutSafetyCheck": bypass_policy_lockout_safety_check, "Tags": tags, "MultiRegion": multi_region}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            ret["comment"] = f"Created '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    
    # TODO perform other modifications as needed here
    ...

    after = await hub.exec.boto3.client.kms.describe_key(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

async def absent(hub, ctx, name: Text, key_id: Text)  -> Dict[str, Any]:
    r'''
    **Autogenerated function**
    
    Sets the state of a customer master key (CMK) to disabled. This change temporarily prevents use of the CMK for
    cryptographic operations.  For more information about how key state affects the use of a CMK, see Key state:
    Effect on your CMK in the  AWS Key Management Service Developer Guide . The CMK that you use for this operation
    must be in a compatible key state. For details, see Key state: Effect on your CMK in the AWS Key Management
    Service Developer Guide.  Cross-account use: No. You cannot perform this operation on a CMK in a different AWS
    account.  Required permissions: kms:DisableKey (key policy)  Related operations: EnableKey

    Args:
        name(Text): A name, ID, or JMES search path to identify the resource.
        key_id(Text): Identifies the customer master key (CMK) to disable. Specify the key ID or key ARN of the CMK.
            For example:   Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab    Key ARN: arn:aws:kms:us-
            east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab    To get the key ID and key ARN
            for a CMK, use ListKeys or DescribeKey.

    Returns:
        Dict[str, Any]

    Examples:

        .. code-block:: sls

            resource_is_absent:
              aws_auto.kms.key.absent:
                - name: value
                - key_id: value
    '''
    
    result = dict(comment="", changes= None, name=name, result=True)
    ret = await hub.exec.boto3.client.kms.key.id(
        ctx,
        jmes_path=name
    )
    if ret["status"]:
        # name is now the first id that matched the JMES search path
        name = ret["ret"]
    

    

    before = await hub.exec.boto3.client.kms.describe_key(name)

    if not before:
        result["comment"] = f"'{name}' already absent"
    else:
        try:
            ret = await hub.exec.boto3.client.kms.disable_key(
                ctx,
                
                
                **{"KeyId": key_id}
            )
            result["result"] = ret["status"]
            if not result["result"]:
                result["comment"] = ret["comment"]
                return result
            result["comment"] = f"Deleted '{name}'"
        except hub.tool.boto3.exception.ClientError as e:
            result["comment"] = f"{e.__class__.__name__}: {e}"

    

    after = await hub.exec.boto3.client.kms.describe_key(name)
    result["changes"] = differ.deep_diff(before, after)
    return result

