<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="keyring-functions-plugin-specific">
      </a>
      8.4.4.13 Plugin-Specific Keyring Key-Management Functions
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045239439232">
  </a>
  <p>
   For each keyring plugin-specific function, this section
        describes its purpose, calling sequence, and return value. For
        information about general-purpose keyring functions, see
   <a class="xref" href="keyring-functions-general-purpose.html" title="8.4.4.12 General-Purpose Keyring Key-Management Functions">
    Section 8.4.4.12, “General-Purpose Keyring Key-Management Functions”
   </a>
   .
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a name="function_keyring-aws-rotate-cmk">
      </a>
      <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-aws-rotate-cmk">
       <code class="literal">
        keyring_aws_rotate_cmk()
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045239433872">
     </a>
     <a class="indexterm" name="idm46045239432768">
     </a>
     <p>
      Associated keyring plugin:
      <code class="literal">
       keyring_aws
      </code>
     </p>
     <p>
      <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-aws-rotate-cmk">
       <code class="literal">
        keyring_aws_rotate_cmk()
       </code>
      </a>
      rotates the AWS KMS key. Rotation changes only the key that
            AWS KMS uses for subsequent data key-encryption operations.
            AWS KMS maintains previous CMK versions, so keys generated
            using previous CMKs remain decryptable after rotation.
     </p>
     <p>
      Rotation changes the CMK value used inside AWS KMS but does
            not change the ID used to refer to it, so there is no need
            to change the
      <a class="link" href="keyring-system-variables.html#sysvar_keyring_aws_cmk_id">
       <code class="literal">
        keyring_aws_cmk_id
       </code>
      </a>
      system
            variable after calling
      <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-aws-rotate-cmk">
       <code class="literal">
        keyring_aws_rotate_cmk()
       </code>
      </a>
      .
     </p>
     <p>
      This function requires the
      <a class="link" href="privileges-provided.html#priv_super">
       <code class="literal">
        SUPER
       </code>
      </a>
      privilege.
     </p>
     <p>
      Arguments:
     </p>
     <p>
      None.
     </p>
     <p>
      Return value:
     </p>
     <p>
      Returns 1 for success, or
      <code class="literal">
       NULL
      </code>
      and an
            error for failure.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="function_keyring-aws-rotate-keys">
      </a>
      <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-aws-rotate-keys">
       <code class="literal">
        keyring_aws_rotate_keys()
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045239418400">
     </a>
     <a class="indexterm" name="idm46045239417296">
     </a>
     <p>
      Associated keyring plugin:
      <code class="literal">
       keyring_aws
      </code>
     </p>
     <p>
      <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-aws-rotate-keys">
       <code class="literal">
        keyring_aws_rotate_keys()
       </code>
      </a>
      rotates keys stored in the
      <code class="literal">
       keyring_aws
      </code>
      storage file named by the
      <a class="link" href="keyring-system-variables.html#sysvar_keyring_aws_data_file">
       <code class="literal">
        keyring_aws_data_file
       </code>
      </a>
      system variable. Rotation sends each key stored in the file
            to AWS KMS for re-encryption using the value of the
      <a class="link" href="keyring-system-variables.html#sysvar_keyring_aws_cmk_id">
       <code class="literal">
        keyring_aws_cmk_id
       </code>
      </a>
      system
            variable as the CMK value, and stores the new encrypted keys
            in the file.
     </p>
     <p>
      <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-aws-rotate-keys">
       <code class="literal">
        keyring_aws_rotate_keys()
       </code>
      </a>
      is
            useful for key re-encryption under these circumstances:
     </p>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         After rotating the CMK; that is, after invoking the
         <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-aws-rotate-cmk">
          <code class="literal">
           keyring_aws_rotate_cmk()
          </code>
         </a>
         function.
        </p>
       </li>
       <li class="listitem">
        <p>
         After changing the
         <a class="link" href="keyring-system-variables.html#sysvar_keyring_aws_cmk_id">
          <code class="literal">
           keyring_aws_cmk_id
          </code>
         </a>
         system variable to a different key value.
        </p>
       </li>
      </ul>
     </div>
     <p>
      This function requires the
      <a class="link" href="privileges-provided.html#priv_super">
       <code class="literal">
        SUPER
       </code>
      </a>
      privilege.
     </p>
     <p>
      Arguments:
     </p>
     <p>
      None.
     </p>
     <p>
      Return value:
     </p>
     <p>
      Returns 1 for success, or
      <code class="literal">
       NULL
      </code>
      and an
            error for failure.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a name="function_keyring-hashicorp-update-config">
      </a>
      <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-hashicorp-update-config">
       <code class="literal">
        keyring_hashicorp_update_config()
       </code>
      </a>
     </p>
     <a class="indexterm" name="idm46045239396240">
     </a>
     <a class="indexterm" name="idm46045239395120">
     </a>
     <p>
      Associated keyring plugin:
      <code class="literal">
       keyring_hashicorp
      </code>
     </p>
     <p>
      When invoked, the
      <a class="link" href="keyring-functions-plugin-specific.html#function_keyring-hashicorp-update-config">
       <code class="literal">
        keyring_hashicorp_update_config()
       </code>
      </a>
      function causes
      <code class="literal">
       keyring_hashicorp
      </code>
      to
            perform a runtime reconfiguration, as described in
      <a class="xref" href="keyring-hashicorp-plugin.html#keyring-hashicorp-plugin-configuration" title="keyring_hashicorp Configuration">
       keyring_hashicorp Configuration
      </a>
      .
     </p>
     <p>
      This function requires the
      <a class="link" href="privileges-provided.html#priv_system-variables-admin">
       <code class="literal">
        SYSTEM_VARIABLES_ADMIN
       </code>
      </a>
      privilege because it modifies global system variables.
     </p>
     <p>
      Arguments:
     </p>
     <p>
      None.
     </p>
     <p>
      Return value:
     </p>
     <p>
      Returns the string
      <code class="literal">
       'Configuration update was
            successful.'
      </code>
      for success, or
      <code class="literal">
       'Configuration update failed.'
      </code>
      for
            failure.
     </p>
    </li>
   </ul>
  </div>
 </div>
 <br/>
</div>
