Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@
*
* @see <a href="http://docs.aws.amazon.com/kms/latest/developerguide/encrypt-context.html">KMS Encryption Context</a>
*/
public class DirectKmsMaterialsProvider implements EncryptionMaterialsProvider {
public class DirectKmsMaterialProvider implements EncryptionMaterialsProvider {

private static final String COVERED_ATTR_CTX_KEY = "aws-kms-ec-attr";
private static final String SIGNING_KEY_ALGORITHM = "amzn-ddb-sig-alg";
Expand All @@ -72,11 +72,11 @@ public class DirectKmsMaterialsProvider implements EncryptionMaterialsProvider {
private final int sigKeyLength;
private final String sigKeyDesc;

public DirectKmsMaterialsProvider(KmsClient kms) {
public DirectKmsMaterialProvider(KmsClient kms) {
this(kms, null);
}

public DirectKmsMaterialsProvider(
public DirectKmsMaterialProvider(
KmsClient kms,
String encryptionKeyId,
Map<String, String> materialDescription
Expand Down Expand Up @@ -106,7 +106,7 @@ public DirectKmsMaterialsProvider(
this.sigKeyLength = parts.length == 2 ? Integer.parseInt(parts[1]) : 256;
}

public DirectKmsMaterialsProvider(KmsClient kms, String encryptionKeyId) {
public DirectKmsMaterialProvider(KmsClient kms, String encryptionKeyId) {
this(kms, encryptionKeyId, Collections.emptyMap());
}

Expand Down Expand Up @@ -249,7 +249,7 @@ protected String getEncryptionKeyId() {

/**
* Select encryption key id to be used to generate data key. The default implementation of this method returns
* {@link DirectKmsMaterialsProvider#encryptionKeyId}.
* {@link DirectKmsMaterialProvider#encryptionKeyId}.
*
* @param context encryption context.
* @return the encryptionKeyId.
Expand Down Expand Up @@ -344,7 +344,7 @@ private static void populateKmsEcFromEc(
);
} else {
throw new UnsupportedOperationException(
"DirectKmsMaterialsProvider only supports String, Number, and Binary HashKeys"
"DirectKmsMaterialProvider only supports String, Number, and Binary HashKeys"
);
}
}
Expand All @@ -369,7 +369,7 @@ private static void populateKmsEcFromEc(
);
} else {
throw new UnsupportedOperationException(
"DirectKmsMaterialsProvider only supports String, Number, and Binary RangeKeys"
"DirectKmsMaterialProvider only supports String, Number, and Binary RangeKeys"
);
}
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.EncryptionFlags;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.AsymmetricStaticProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.CachingMostRecentProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialsProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.EncryptionMaterialsProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.SymmetricStaticProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.WrappedMaterialsProvider;
Expand Down Expand Up @@ -872,13 +872,13 @@ private EncryptionMaterialsProvider createProvider(
}
case ScenarioManifest.AWS_KMS_PROVIDER_NAME:
if (materialDescription != null && !materialDescription.isEmpty()) {
return new DirectKmsMaterialsProvider(
return new DirectKmsMaterialProvider(
kmsClient,
keyDataMap.get(keys.decryptName).keyId,
materialDescription
);
}
return new DirectKmsMaterialsProvider(
return new DirectKmsMaterialProvider(
kmsClient,
keyDataMap.get(keys.decryptName).keyId
);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.DynamoDBEncryptor;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.EncryptionContext;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.EncryptionFlags;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialsProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.testing.DdbRecordMatcher;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.testing.ScenarioManifest;
import com.fasterxml.jackson.core.type.TypeReference;
Expand Down Expand Up @@ -114,7 +114,7 @@ public static void decryptNonBmpHashKeyVectorAndWithNullKeyId(
loadKeyData(scenarioManifest.keyDataPath);

DynamoDBEncryptor encryptor = DynamoDBEncryptor.getInstance(
new DirectKmsMaterialsProvider(kmsClient)
new DirectKmsMaterialProvider(kmsClient)
);
EncryptionContext ctx = EncryptionContext
.builder()
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@
import software.amazon.awssdk.services.kms.model.GenerateDataKeyRequest;
import software.amazon.awssdk.services.kms.model.GenerateDataKeyResponse;

public class DirectKmsMaterialsProviderTest {
public class DirectKmsMaterialProviderTest {

private FakeKMS kms;
private String keyId;
Expand All @@ -64,10 +64,7 @@ public void setUp() {

@Test
public void simple() {
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);

EncryptionMaterials eMat = prov.getEncryptionMaterials(ctx);
SecretKey encryptionKey = eMat.getEncryptionKey();
Expand Down Expand Up @@ -96,10 +93,7 @@ public void simple() {

@Test
public void simpleWithKmsEc() {
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);

Map<String, AttributeValue> attrVals = new HashMap<>();
attrVals.put("hk", AttributeValue.builder().s("HashKeyValue").build());
Expand Down Expand Up @@ -136,10 +130,7 @@ public void simpleWithKmsEc() {

@Test
public void simpleWithKmsEc2() throws GeneralSecurityException {
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);

Map<String, AttributeValue> attrVals = new HashMap<>();
attrVals.put("hk", AttributeValue.builder().n("10").build());
Expand Down Expand Up @@ -176,10 +167,7 @@ public void simpleWithKmsEc2() throws GeneralSecurityException {

@Test
public void simpleWithKmsEc3() throws GeneralSecurityException {
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);

Map<String, AttributeValue> attrVals = new HashMap<>();
attrVals.put(
Expand Down Expand Up @@ -243,10 +231,7 @@ public void simpleWithKmsEc3() throws GeneralSecurityException {

@Test
public void randomEnvelopeKeys() throws GeneralSecurityException {
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);

EncryptionMaterials eMat = prov.getEncryptionMaterials(ctx);
SecretKey encryptionKey = eMat.getEncryptionKey();
Expand All @@ -264,10 +249,7 @@ public void randomEnvelopeKeys() throws GeneralSecurityException {
@Test
public void testRefresh() {
// This does nothing, make sure we don't throw and exception.
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);
prov.refresh();
}

Expand All @@ -276,7 +258,7 @@ public void explicitContentKeyAlgorithm() throws GeneralSecurityException {
Map<String, String> desc = new HashMap<>();
desc.put(WrappedRawMaterials.CONTENT_KEY_ALGORITHM, "AES");

DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(
kms,
keyId,
desc
Expand All @@ -301,7 +283,7 @@ public void explicitContentKeyLength128() throws GeneralSecurityException {
Map<String, String> desc = new HashMap<>();
desc.put(WrappedRawMaterials.CONTENT_KEY_ALGORITHM, "AES/128");

DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(
kms,
keyId,
desc
Expand All @@ -328,7 +310,7 @@ public void explicitContentKeyLength256() throws GeneralSecurityException {
Map<String, String> desc = new HashMap<>();
desc.put(WrappedRawMaterials.CONTENT_KEY_ALGORITHM, "AES/256");

DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(
kms,
keyId,
desc
Expand Down Expand Up @@ -398,7 +380,7 @@ public void extendedWithDerivedEncryptionKeyId() {

@Test(expectedExceptions = SdkException.class)
public void encryptionKeyIdMismatch() throws SdkException {
DirectKmsMaterialsProvider directProvider = new DirectKmsMaterialsProvider(
DirectKmsMaterialProvider directProvider = new DirectKmsMaterialProvider(
kms,
keyId
);
Expand Down Expand Up @@ -469,12 +451,12 @@ public GenerateDataKeyResponse generateDataKey(GenerateDataKeyRequest r) {
}
};
assertFalse(gdkCalled.get());
new DirectKmsMaterialsProvider(kmsSpy, keyId).getEncryptionMaterials(ctx);
new DirectKmsMaterialProvider(kmsSpy, keyId).getEncryptionMaterials(ctx);
assertTrue(gdkCalled.get());
}

private static class ExtendedKmsMaterialsProvider
extends DirectKmsMaterialsProvider {
extends DirectKmsMaterialProvider {

private final String encryptionKeyIdAttributeName;

Expand Down Expand Up @@ -553,15 +535,12 @@ private static EncryptionContext ctx(EncryptionMaterials mat) {

@Test(expectedExceptions = NullPointerException.class)
public void constructorNullKmsClient() {
new DirectKmsMaterialsProvider(null, keyId);
new DirectKmsMaterialProvider(null, keyId);
}

@Test(expectedExceptions = UnsupportedOperationException.class)
public void unsupportedHashKeyType() {
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);
Map<String, AttributeValue> attrVals = new HashMap<>();
attrVals.put("hk", AttributeValue.builder().bool(true).build());
EncryptionContext boolCtx = new EncryptionContext.Builder()
Expand All @@ -573,10 +552,7 @@ public void unsupportedHashKeyType() {

@Test(expectedExceptions = UnsupportedOperationException.class)
public void unsupportedRangeKeyType() {
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);
Map<String, AttributeValue> attrVals = new HashMap<>();
attrVals.put("hk", AttributeValue.builder().s("HashKeyValue").build());
attrVals.put("rk", AttributeValue.builder().bool(true).build());
Expand All @@ -590,10 +566,7 @@ public void unsupportedRangeKeyType() {

@Test(expectedExceptions = NullPointerException.class)
public void hashKeyMissingFromAttributeValues() {
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);
EncryptionContext missingCtx = new EncryptionContext.Builder()
.hashKeyName("hk")
.attributeValues(Collections.emptyMap())
Expand All @@ -603,10 +576,7 @@ public void hashKeyMissingFromAttributeValues() {

@Test(expectedExceptions = NullPointerException.class)
public void rangeKeyMissingFromAttributeValues() {
DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(
kms,
keyId
);
DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);
Map<String, AttributeValue> attrVals = new HashMap<>();
attrVals.put("hk", AttributeValue.builder().s("HashKeyValue").build());
EncryptionContext missingCtx = new EncryptionContext.Builder()
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.DynamoDBEncryptor;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.EncryptionContext;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.EncryptionFlags;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialsProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialProvider;
import java.security.GeneralSecurityException;
import java.util.EnumSet;
import java.util.HashMap;
Expand Down Expand Up @@ -54,8 +54,8 @@ public static void encryptRecord(
);
record.put(IGNORED_FIELD_NAME, AttributeValue.builder().s("alone").build());

// Create DirectKmsMaterialsProvider
final DirectKmsMaterialsProvider cmp = new DirectKmsMaterialsProvider(
// Create DirectKmsMaterialProvider
final DirectKmsMaterialProvider cmp = new DirectKmsMaterialProvider(
kmsClient,
cmkArn
);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.DynamoDBEncryptor;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.EncryptionContext;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.EncryptionFlags;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialsProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialProvider;
import java.security.GeneralSecurityException;
import java.util.EnumSet;
import java.util.HashMap;
Expand Down Expand Up @@ -104,8 +104,10 @@ public static void encryptRecord(
record.put(IGNORED_FIELD_NAME, AttributeValue.builder().s("alone").build());

// Set up encryptor with first region's KMS key
final DirectKmsMaterialsProvider cmpEncrypt =
new DirectKmsMaterialsProvider(kmsEncrypt, cmkArnEncrypt);
final DirectKmsMaterialProvider cmpEncrypt = new DirectKmsMaterialProvider(
kmsEncrypt,
cmkArnEncrypt
);
final DynamoDBEncryptor encryptor = DynamoDBEncryptor.getInstance(
cmpEncrypt
);
Expand Down Expand Up @@ -149,8 +151,10 @@ public static void encryptRecord(
);

// Set up decryptor using the replica key from second region
final DirectKmsMaterialsProvider cmpDecrypt =
new DirectKmsMaterialsProvider(kmsDecrypt, cmkArnDecrypt);
final DirectKmsMaterialProvider cmpDecrypt = new DirectKmsMaterialProvider(
kmsDecrypt,
cmkArnDecrypt
);
final DynamoDBEncryptor decryptor = DynamoDBEncryptor.getInstance(
cmpDecrypt
);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.EncryptionContext;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.EncryptionFlags;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.CachingMostRecentProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialsProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.store.MetaStore;
import java.security.GeneralSecurityException;
import java.util.EnumSet;
Expand All @@ -22,7 +22,7 @@

/**
* This demonstrates how to use the CachingMostRecentProvider backed by a MetaStore
* and the DirectKmsMaterialsProvider to encrypt your data.
* and the DirectKmsMaterialProvider to encrypt your data.
*/
public class MostRecentEncryptedItem {

Expand Down Expand Up @@ -62,7 +62,7 @@ public static void encryptRecord(
record.put(IGNORED_FIELD_NAME, AttributeValue.builder().s("alone").build());

// Provider Configuration to protect the data keys
final DirectKmsMaterialsProvider kmsProv = new DirectKmsMaterialsProvider(
final DirectKmsMaterialProvider kmsProv = new DirectKmsMaterialProvider(
kmsClient,
cmkArn
);
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
package software.amazon.cryptography.examples.migration.awsdbe;

import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.DynamoDBEncryptor;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialsProvider;
import com.amazonaws.services.dynamodbv2.datamodeling.sdkv2.encryption.providers.DirectKmsMaterialProvider;
import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
Expand Down Expand Up @@ -100,7 +100,7 @@ public static void MigrationStep1(

// 5. Configure the same DynamoDBEncryptor that we did in Step 0.
final KmsClient kmsClient = KmsClient.create();
final DirectKmsMaterialsProvider cmp = new DirectKmsMaterialsProvider(
final DirectKmsMaterialProvider cmp = new DirectKmsMaterialProvider(
kmsClient,
kmsKeyId
);
Expand Down
Loading
Loading