{
  "typeName" : "AWS::PaymentCryptography::Key",
  "description" : "Definition of AWS::PaymentCryptography::Key Resource Type",
  "definitions" : {
    "DeriveKeyUsage" : {
      "type" : "string",
      "enum" : [ "TR31_B0_BASE_DERIVATION_KEY", "TR31_C0_CARD_VERIFICATION_KEY", "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY", "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS", "TR31_E1_EMV_MKEY_CONFIDENTIALITY", "TR31_E2_EMV_MKEY_INTEGRITY", "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS", "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION", "TR31_E6_EMV_MKEY_OTHER", "TR31_K0_KEY_ENCRYPTION_KEY", "TR31_K1_KEY_BLOCK_PROTECTION_KEY", "TR31_M3_ISO_9797_3_MAC_KEY", "TR31_M1_ISO_9797_1_MAC_KEY", "TR31_M6_ISO_9797_5_CMAC_KEY", "TR31_M7_HMAC_KEY", "TR31_P0_PIN_ENCRYPTION_KEY", "TR31_P1_PIN_GENERATION_KEY", "TR31_V1_IBM3624_PIN_VERIFICATION_KEY", "TR31_V2_VISA_PIN_VERIFICATION_KEY" ]
    },
    "KeyAlgorithm" : {
      "type" : "string",
      "enum" : [ "TDES_2KEY", "TDES_3KEY", "AES_128", "AES_192", "AES_256", "HMAC_SHA256", "HMAC_SHA384", "HMAC_SHA512", "HMAC_SHA224", "RSA_2048", "RSA_3072", "RSA_4096", "ECC_NIST_P256", "ECC_NIST_P384", "ECC_NIST_P521" ]
    },
    "KeyAttributes" : {
      "type" : "object",
      "properties" : {
        "KeyUsage" : {
          "$ref" : "#/definitions/KeyUsage"
        },
        "KeyClass" : {
          "$ref" : "#/definitions/KeyClass"
        },
        "KeyAlgorithm" : {
          "$ref" : "#/definitions/KeyAlgorithm"
        },
        "KeyModesOfUse" : {
          "$ref" : "#/definitions/KeyModesOfUse"
        }
      },
      "required" : [ "KeyAlgorithm", "KeyClass", "KeyModesOfUse", "KeyUsage" ],
      "additionalProperties" : false
    },
    "KeyCheckValueAlgorithm" : {
      "type" : "string",
      "enum" : [ "CMAC", "ANSI_X9_24", "HMAC", "SHA_1" ]
    },
    "KeyClass" : {
      "type" : "string",
      "enum" : [ "SYMMETRIC_KEY", "ASYMMETRIC_KEY_PAIR", "PRIVATE_KEY", "PUBLIC_KEY" ]
    },
    "KeyModesOfUse" : {
      "type" : "object",
      "properties" : {
        "Encrypt" : {
          "type" : "boolean",
          "default" : false
        },
        "Decrypt" : {
          "type" : "boolean",
          "default" : false
        },
        "Wrap" : {
          "type" : "boolean",
          "default" : false
        },
        "Unwrap" : {
          "type" : "boolean",
          "default" : false
        },
        "Generate" : {
          "type" : "boolean",
          "default" : false
        },
        "Sign" : {
          "type" : "boolean",
          "default" : false
        },
        "Verify" : {
          "type" : "boolean",
          "default" : false
        },
        "DeriveKey" : {
          "type" : "boolean",
          "default" : false
        },
        "NoRestrictions" : {
          "type" : "boolean",
          "default" : false
        }
      },
      "additionalProperties" : false
    },
    "KeyOrigin" : {
      "type" : "string",
      "description" : "Defines the source of a key",
      "enum" : [ "EXTERNAL", "AWS_PAYMENT_CRYPTOGRAPHY" ]
    },
    "KeyReplicationState" : {
      "type" : "string",
      "description" : "Defines the replication state of a key",
      "enum" : [ "IN_PROGRESS", "DELETE_IN_PROGRESS", "FAILED", "SYNCHRONIZED" ]
    },
    "KeyState" : {
      "type" : "string",
      "description" : "Defines the state of a key",
      "enum" : [ "CREATE_IN_PROGRESS", "CREATE_COMPLETE", "DELETE_PENDING", "DELETE_COMPLETE" ]
    },
    "KeyUsage" : {
      "type" : "string",
      "enum" : [ "TR31_B0_BASE_DERIVATION_KEY", "TR31_C0_CARD_VERIFICATION_KEY", "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY", "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION", "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS", "TR31_E1_EMV_MKEY_CONFIDENTIALITY", "TR31_E2_EMV_MKEY_INTEGRITY", "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS", "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION", "TR31_E6_EMV_MKEY_OTHER", "TR31_K0_KEY_ENCRYPTION_KEY", "TR31_K1_KEY_BLOCK_PROTECTION_KEY", "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT", "TR31_M0_ISO_16609_MAC_KEY", "TR31_M3_ISO_9797_3_MAC_KEY", "TR31_M1_ISO_9797_1_MAC_KEY", "TR31_M6_ISO_9797_5_CMAC_KEY", "TR31_M7_HMAC_KEY", "TR31_P0_PIN_ENCRYPTION_KEY", "TR31_P1_PIN_GENERATION_KEY", "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE", "TR31_V1_IBM3624_PIN_VERIFICATION_KEY", "TR31_V2_VISA_PIN_VERIFICATION_KEY", "TR31_K2_TR34_ASYMMETRIC_KEY" ]
    },
    "ReplicationStatus" : {
      "type" : "object",
      "patternProperties" : {
        "^[a-z]{2}-[a-z]{1,16}-[0-9]+$" : {
          "$ref" : "#/definitions/ReplicationStatusType"
        }
      },
      "additionalProperties" : false
    },
    "ReplicationStatusType" : {
      "type" : "object",
      "properties" : {
        "Status" : {
          "$ref" : "#/definitions/KeyReplicationState"
        },
        "StatusMessage" : {
          "type" : "string"
        }
      },
      "required" : [ "Status" ],
      "additionalProperties" : false
    },
    "Tag" : {
      "type" : "object",
      "properties" : {
        "Key" : {
          "type" : "string",
          "maxLength" : 128,
          "minLength" : 1
        },
        "Value" : {
          "type" : "string",
          "maxLength" : 256,
          "minLength" : 1
        }
      },
      "required" : [ "Key", "Value" ],
      "additionalProperties" : false
    }
  },
  "properties" : {
    "DeriveKeyUsage" : {
      "$ref" : "#/definitions/DeriveKeyUsage"
    },
    "Enabled" : {
      "type" : "boolean"
    },
    "Exportable" : {
      "type" : "boolean"
    },
    "KeyAttributes" : {
      "$ref" : "#/definitions/KeyAttributes"
    },
    "KeyCheckValueAlgorithm" : {
      "$ref" : "#/definitions/KeyCheckValueAlgorithm"
    },
    "KeyIdentifier" : {
      "type" : "string",
      "maxLength" : 322,
      "minLength" : 7,
      "pattern" : "^arn:aws:payment-cryptography:[a-z]{2}-[a-z]{1,16}-[0-9]+:[0-9]{12}:(key/[0-9a-zA-Z]{16,64}|alias/[a-zA-Z0-9/_-]+)$|^alias/[a-zA-Z0-9/_-]+$"
    },
    "KeyOrigin" : {
      "$ref" : "#/definitions/KeyOrigin"
    },
    "KeyState" : {
      "$ref" : "#/definitions/KeyState"
    },
    "Policy" : {
      "type" : "string",
      "maxLength" : 20480,
      "minLength" : 1,
      "pattern" : "^[\\u0009\\u000A\\u000D\\u0020-\\u00FF]+$",
      "description" : "The resource-based policy attached to the key, in JSON format."
    },
    "ReplicationRegions" : {
      "type" : "array",
      "items" : {
        "type" : "string",
        "pattern" : "^[a-z]{2}-[a-z]{1,16}-[0-9]+$"
      }
    },
    "ReplicationStatus" : {
      "$ref" : "#/definitions/ReplicationStatus"
    },
    "Tags" : {
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/Tag"
      },
      "maxItems" : 200,
      "minItems" : 0,
      "insertionOrder" : false
    }
  },
  "required" : [ "Exportable", "KeyAttributes" ],
  "readOnlyProperties" : [ "/properties/KeyIdentifier", "/properties/KeyOrigin", "/properties/KeyState", "/properties/ReplicationStatus" ],
  "writeOnlyProperties" : [ "/properties/ReplicationRegions" ],
  "primaryIdentifier" : [ "/properties/KeyIdentifier" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "payment-cryptography:GetKey", "payment-cryptography:CreateKey", "payment-cryptography:TagResource", "payment-cryptography:PutResourcePolicy" ]
    },
    "read" : {
      "permissions" : [ "payment-cryptography:GetKey", "payment-cryptography:ListTagsForResource", "payment-cryptography:GetResourcePolicy" ]
    },
    "update" : {
      "permissions" : [ "payment-cryptography:GetKey", "payment-cryptography:ListTagsForResource", "payment-cryptography:TagResource", "payment-cryptography:UntagResource", "payment-cryptography:StartKeyUsage", "payment-cryptography:StopKeyUsage", "payment-cryptography:AddKeyReplicationRegions", "payment-cryptography:RemoveKeyReplicationRegions", "payment-cryptography:PutResourcePolicy", "payment-cryptography:DeleteResourcePolicy" ]
    },
    "delete" : {
      "permissions" : [ "payment-cryptography:GetKey", "payment-cryptography:DeleteKey" ]
    },
    "list" : {
      "permissions" : [ "payment-cryptography:ListKeys" ]
    }
  },
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "payment-cryptography:ListTagsForResource", "payment-cryptography:TagResource", "payment-cryptography:UntagResource" ]
  },
  "additionalProperties" : false
}