BedrockAgentCoreControl / Client / reset_token_vault_key_material

reset_token_vault_key_material

BedrockAgentCoreControl.Client.reset_token_vault_key_material(**kwargs)

Resets the key material for a token vault whose customer managed KMS key has been deleted, and re-encrypts the token vault with an Amazon Web Services managed key so that you can use the token vault again.

Warning

This operation can’t be undone. The reset permanently deletes the OAuth2 access tokens and refresh tokens stored in the token vault, including tokens obtained through all supported flows. After the reset, your agents must complete these flows again to get new tokens, and for user-delegated flows your users must authorize access again. The reset doesn’t delete your credential providers or their configuration.

You can reset a token vault only if its customer managed key has been deleted. If the key still exists, including when it’s disabled or scheduled for deletion, this operation returns a ValidationException. To use the token vault again, enable the key or cancel its scheduled deletion in KMS. To switch to a different key, use SetTokenVaultCMK.

See also: AWS API Documentation

Request Syntax

response = client.reset_token_vault_key_material(
    tokenVaultId='string'
)
Parameters:

tokenVaultId (string) –

[REQUIRED]

The unique identifier of the token vault to reset. To reset your account’s default token vault, specify default.

Return type:

dict

Returns:

Response Syntax

{
    'tokenVaultId': 'string',
    'kmsConfiguration': {
        'keyType': 'CustomerManagedKey'|'ServiceManagedKey',
        'kmsKeyArn': 'string'
    },
    'lastModifiedDate': datetime(2015, 1, 1)
}

Response Structure

  • (dict) –

    • tokenVaultId (string) –

      The ID of the token vault.

    • kmsConfiguration (dict) –

      The KMS configuration for the token vault after the reset. The token vault uses an Amazon Web Services managed key.

      • keyType (string) –

        The type of KMS key (CustomerManagedKey or ServiceManagedKey).

      • kmsKeyArn (string) –

        The Amazon Resource Name (ARN) of the KMS key.

    • lastModifiedDate (datetime) –

      The timestamp when the token vault was last modified.

Exceptions