chore(java): bring commits from main

.github/workflows/ci_test_vector_java.yml

@@ -26,6 +26,7 @@ on:
 jobs:
   testJava:
     strategy:
+      fail-fast: false
       matrix:
         library: [TestVectors]
         java-version: [8, 11, 17, 19]

DynamoDbEncryption/runtimes/java/src/test/sdkv1/com/amazonaws/services/dynamodbv2/datamodeling/encryption/providers/CachingMostRecentProviderTests.java

@@ -190,8 +190,9 @@ public void testSingleVersion() throws InterruptedException {
       0,
       store.getVersionFromMaterialDescription(eMat2.getMaterialDescription())
     );
-    // Let the TTL be exceeded
-    Thread.sleep(500);
+    // Let the TTL be exceeded; sleep must be > TTL (500ms) to reliably
+    // land in the grace period and trigger a cache refresh.
+    Thread.sleep(700);
     final EncryptionMaterials eMat3 = prov.getEncryptionMaterials(ctx);
     assertEquals(2, methodCalls.size());
     assertEquals(1, (int) methodCalls.getOrDefault("query", 0)); // To find current version
@@ -356,8 +357,9 @@ public void testTwoVersions() throws InterruptedException {
       "Expected no calls but was " + methodCalls.toString(),
       methodCalls.isEmpty()
     );
-    // Let the TTL be exceeded
-    Thread.sleep(500);
+    // Let the TTL be exceeded; sleep must be > TTL (500ms) to reliably
+    // land in the grace period and trigger a cache refresh.
+    Thread.sleep(700);
     final EncryptionMaterials eMat3 = prov.getEncryptionMaterials(ctx);
 
     assertEquals(1, (int) methodCalls.getOrDefault("query", 0)); // To find current version
@@ -512,8 +514,9 @@ public void testSingleVersionTwoMaterials() throws InterruptedException {
       store.getVersionFromMaterialDescription(eMat2_2.getMaterialDescription())
     );
 
-    // Let the TTL be exceeded
-    Thread.sleep(500);
+    // Let the TTL be exceeded; sleep must be > TTL (500ms) to reliably
+    // land in the grace period and trigger a cache refresh.
+    Thread.sleep(700);
     final EncryptionMaterials eMat3_1 = prov.getEncryptionMaterials(ctx1);
     assertEquals(2, methodCalls.size());
     assertEquals(1, (int) methodCalls.get("query")); // To find current version

DynamoDbEncryption/runtimes/java/src/test/sdkv1/com/amazonaws/services/dynamodbv2/mapper/integration/ScanITCase.java

@@ -237,8 +237,17 @@ public void testParallelScanExceptionHandling() {
       assertNotNull(ase.getErrorCode());
       assertNotNull(ase.getErrorType());
       assertNotNull(ase.getMessage());
+    } catch (java.util.concurrent.RejectedExecutionException e) {
+      // This is expected when the thread pool shuts down after the first
+      // segment fails with AmazonServiceException, causing the second
+      // segment's task to be rejected.
     } catch (Exception e) {
-      fail("Should have seen the AmazonServiceException");
+      fail(
+        "Should have seen AmazonServiceException or RejectedExecutionException, but got: " +
+        e.getClass().getName() +
+        ": " +
+        e.getMessage()
+      );
     }
   }
 

Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/ExampleUtils.java

@@ -0,0 +1,32 @@
+// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+package software.amazon.cryptography.examples;
+
+import java.util.concurrent.ThreadLocalRandom;
+
+/**
+ * Shared utilities for examples. The TEST_SUFFIX provides a unique suffix
+ * per JVM process so that parallel CI matrix jobs (different Java versions / OS)
+ * do not overwrite each other's items in the shared DynamoDB test table.
+ *
+ * Each example uses a hardcoded partition key like "rawEcdhKeyringItem".
+ * In CI, multiple JVMs run in parallel against the same table. Without
+ * isolation, one JVM can overwrite another's item, causing decrypt failures.
+ * By appending a random suffix, each JVM writes to its own partition key
+ * (e.g., "rawEcdhKeyringItem-482913") while keeping cross-example reads
+ * working within the same JVM.
+ */
+public class ExampleUtils {
+
+  private static final String TEST_SUFFIX = String.valueOf(
+    ThreadLocalRandom.current().nextInt(100000, 999999)
+  );
+
+  /**
+   * Returns a partition key value unique to this JVM process.
+   * Example: "rawEcdhKeyringItem" becomes "rawEcdhKeyringItem-482913"
+   */
+  public static String uniquePk(String base) {
+    return base + "-" + TEST_SUFFIX;
+  }
+}

Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/clientsupplier/ClientSupplierExample.java

@@ -15,6 +15,7 @@
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTableEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTablesEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.structuredencryption.model.CryptoAction;
+import software.amazon.cryptography.examples.ExampleUtils;
 import software.amazon.cryptography.materialproviders.IKeyring;
 import software.amazon.cryptography.materialproviders.MaterialProviders;
 import software.amazon.cryptography.materialproviders.model.CreateAwsKmsMrkDiscoveryMultiKeyringInput;
@@ -166,7 +167,10 @@ public static void ClientSupplierPutItemGetItem(
     final HashMap<String, AttributeValue> item = new HashMap<>();
     item.put(
       "partition_key",
-      AttributeValue.builder().s("clientSupplierItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("clientSupplierItem"))
+        .build()
     );
     item.put("sort_key", AttributeValue.builder().n("0").build());
     item.put(
@@ -191,7 +195,10 @@ public static void ClientSupplierPutItemGetItem(
     final HashMap<String, AttributeValue> keyToGet = new HashMap<>();
     keyToGet.put(
       "partition_key",
-      AttributeValue.builder().s("clientSupplierItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("clientSupplierItem"))
+        .build()
     );
     keyToGet.put("sort_key", AttributeValue.builder().n("0").build());
 
@@ -289,7 +296,10 @@ public static void ClientSupplierPutItemGetItem(
       new HashMap<>();
     onlyReplicaKeyKeyToGet.put(
       "partition_key",
-      AttributeValue.builder().s("awsKmsMrkMultiKeyringItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("awsKmsMrkMultiKeyringItem"))
+        .build()
     );
     onlyReplicaKeyKeyToGet.put(
       "sort_key",

Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/enhanced/EnhancedPutGetExample.java

@@ -17,6 +17,8 @@
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.enhancedclient.CreateDynamoDbEncryptionInterceptorInput;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.enhancedclient.DynamoDbEnhancedClientEncryption;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.enhancedclient.DynamoDbEnhancedTableEncryptionConfig;
+import software.amazon.cryptography.examples.ExampleUtils;
+import software.amazon.cryptography.examples.ExampleUtils;
 import software.amazon.cryptography.materialproviders.IKeyring;
 import software.amazon.cryptography.materialproviders.MaterialProviders;
 import software.amazon.cryptography.materialproviders.model.CreateAwsKmsMrkMultiKeyringInput;
@@ -153,7 +155,7 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
     //    The item will be encrypted client-side according to your
     //    configuration above before it is sent to DynamoDb.
     final SimpleClass4 item = new SimpleClass4();
-    item.setPartitionKey("EnhancedPutGetExample");
+    item.setPartitionKey(ExampleUtils.uniquePk("EnhancedPutGetExample"));
     item.setSortKey(0);
     item.setAttribute1("encrypt and sign me!");
     item.setAttribute2("sign me!");
@@ -167,7 +169,7 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
     //    original item.
     final Key key = Key
       .builder()
-      .partitionValue("EnhancedPutGetExample")
+      .partitionValue(ExampleUtils.uniquePk("EnhancedPutGetExample"))
       .sortValue(0)
       .build();
 
@@ -181,7 +183,8 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
 
     // retrieve the same record via a Query
     PageIterable<SimpleClass4> items = table.query(
-      QueryConditional.keyEqualTo(k -> k.partitionValue("EnhancedPutGetExample")
+      QueryConditional.keyEqualTo(k ->
+        k.partitionValue(ExampleUtils.uniquePk("EnhancedPutGetExample"))
       )
     );
     List<SimpleClass4> itemList = new ArrayList<SimpleClass4>();

Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/enhanced/LombokPutGetExample.java

@@ -27,6 +27,8 @@
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.enhancedclient.DynamoDbEnhancedClientEncryption;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.enhancedclient.DynamoDbEnhancedTableEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.DynamoDbItemEncryptor;
+import software.amazon.cryptography.examples.ExampleUtils;
+import software.amazon.cryptography.examples.ExampleUtils;
 import software.amazon.cryptography.materialproviders.IKeyring;
 import software.amazon.cryptography.materialproviders.MaterialProviders;
 import software.amazon.cryptography.materialproviders.model.CreateAwsKmsMrkMultiKeyringInput;
@@ -163,7 +165,7 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
     //    configuration above before it is sent to DynamoDb.
     final SimpleViaLombok.SimpleViaLombokBuilder itemBuilder =
       SimpleViaLombok.builder();
-    itemBuilder.partitionKey("LombokPutGetExample");
+    itemBuilder.partitionKey(ExampleUtils.uniquePk("LombokPutGetExample"));
     itemBuilder.sortKey(0);
     itemBuilder.attribute1("encrypt and sign me!");
     itemBuilder.attribute2("sign me!");
@@ -176,7 +178,7 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
     //    original item.
     final Key key = Key
       .builder()
-      .partitionValue("LombokPutGetExample")
+      .partitionValue(ExampleUtils.uniquePk("LombokPutGetExample"))
       .sortValue(0)
       .build();
 

Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/enhanced/SingleTableExample.java

@@ -16,6 +16,8 @@
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.enhancedclient.CreateDynamoDbEncryptionInterceptorInput;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.enhancedclient.DynamoDbEnhancedClientEncryption;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.enhancedclient.DynamoDbEnhancedTableEncryptionConfig;
+import software.amazon.cryptography.examples.ExampleUtils;
+import software.amazon.cryptography.examples.ExampleUtils;
 import software.amazon.cryptography.materialproviders.IKeyring;
 import software.amazon.cryptography.materialproviders.MaterialProviders;
 import software.amazon.cryptography.materialproviders.model.CreateAwsKmsMrkMultiKeyringInput;
@@ -168,21 +170,21 @@ public static void TransactWriteItems(String kmsKeyId, String ddbTableName) {
     //    The item will be encrypted client-side according to your
     //    configuration above before it is sent to DynamoDb.
     final SimpleClass item1 = new SimpleClass();
-    item1.setPartitionKey("EnhancedPutGetExample1");
+    item1.setPartitionKey(ExampleUtils.uniquePk("EnhancedPutGetExample1"));
     item1.setSortKey(0);
     item1.setAttribute1("item1 encrypt and sign me!");
     item1.setAttribute2("item1 sign me!");
     item1.setAttribute3("item1 ignore me!");
 
     final SimpleClass2 item2 = new SimpleClass2();
-    item2.setPartitionKey("EnhancedPutGetExample2");
+    item2.setPartitionKey(ExampleUtils.uniquePk("EnhancedPutGetExample2"));
     item2.setSortKey(0);
     item2.setAttribute4("item2 encrypt and sign me!");
     item2.setAttribute5("item2 sign me!");
     item2.setAttribute3("item2 ignore me!");
 
     final SimpleClass3 item3 = new SimpleClass3();
-    item3.setPartitionKey("EnhancedPutGetExample3");
+    item3.setPartitionKey(ExampleUtils.uniquePk("EnhancedPutGetExample3"));
     item3.setSortKey(0);
     item3.setAttribute6("item3 encrypt and sign me!");
     item3.setAttribute2("item3 sign me!");
@@ -202,15 +204,15 @@ public static void TransactWriteItems(String kmsKeyId, String ddbTableName) {
     //    The item will be decrypted client-side, and you will get back the
     //    original item.
     final SimpleClass key1 = new SimpleClass();
-    key1.setPartitionKey("EnhancedPutGetExample1");
+    key1.setPartitionKey(ExampleUtils.uniquePk("EnhancedPutGetExample1"));
     key1.setSortKey(0);
 
     final SimpleClass2 key2 = new SimpleClass2();
-    key2.setPartitionKey("EnhancedPutGetExample2");
+    key2.setPartitionKey(ExampleUtils.uniquePk("EnhancedPutGetExample2"));
     key2.setSortKey(0);
 
     final SimpleClass3 key3 = new SimpleClass3();
-    key3.setPartitionKey("EnhancedPutGetExample3");
+    key3.setPartitionKey(ExampleUtils.uniquePk("EnhancedPutGetExample3"));
     key3.setSortKey(0);
 
     final TransactGetItemsEnhancedRequest getRequest =

Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/enhanced/TableSchemaBuilderPutGetExample.java

@@ -31,6 +31,8 @@
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.enhancedclient.SignOnlyTag;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.itemencryptor.DynamoDbItemEncryptor;
 import software.amazon.cryptography.examples.ConfigUtils;
+import software.amazon.cryptography.examples.ExampleUtils;
+import software.amazon.cryptography.examples.ExampleUtils;
 import software.amazon.cryptography.materialproviders.IKeyring;
 import software.amazon.cryptography.materialproviders.MaterialProviders;
 import software.amazon.cryptography.materialproviders.model.CreateAwsKmsMrkMultiKeyringInput;
@@ -212,7 +214,9 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
     //    The item will be encrypted client-side according to your
     //    configuration above before it is sent to DynamoDb.
     final SimpleClass item = new SimpleClass();
-    item.setPartitionKey("TableSchemaBuilderPutGetExample");
+    item.setPartitionKey(
+      ExampleUtils.uniquePk("TableSchemaBuilderPutGetExample")
+    );
     item.setSortKey(0);
     item.setAttribute1("encrypt and sign me!");
     item.setAttribute2("sign me!");
@@ -224,7 +228,7 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
     //    original item.
     final Key key = Key
       .builder()
-      .partitionValue("TableSchemaBuilderPutGetExample")
+      .partitionValue(ExampleUtils.uniquePk("TableSchemaBuilderPutGetExample"))
       .sortValue(0)
       .build();
 

Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/keyring/KmsEcdhKeyringExample.java

@@ -40,6 +40,7 @@
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTableEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTablesEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.structuredencryption.model.CryptoAction;
+import software.amazon.cryptography.examples.ExampleUtils;
 import software.amazon.cryptography.materialproviders.IKeyring;
 import software.amazon.cryptography.materialproviders.MaterialProviders;
 import software.amazon.cryptography.materialproviders.model.CreateAwsKmsEcdhKeyringInput;
@@ -339,7 +340,10 @@ private static void GetItemWithKeyring(
     final HashMap<String, AttributeValue> keyToGet = new HashMap<>();
     keyToGet.put(
       "partition_key",
-      AttributeValue.builder().s("awsKmsEcdhKeyringItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("awsKmsEcdhKeyringItem"))
+        .build()
     );
     keyToGet.put("sort_key", AttributeValue.builder().n("0").build());
 
@@ -456,7 +460,10 @@ private static void PutGetItemWithKeyring(
     final HashMap<String, AttributeValue> item = new HashMap<>();
     item.put(
       "partition_key",
-      AttributeValue.builder().s("awsKmsEcdhKeyringItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("awsKmsEcdhKeyringItem"))
+        .build()
     );
     item.put("sort_key", AttributeValue.builder().n("0").build());
     item.put(
@@ -481,7 +488,10 @@ private static void PutGetItemWithKeyring(
     final HashMap<String, AttributeValue> keyToGet = new HashMap<>();
     keyToGet.put(
       "partition_key",
-      AttributeValue.builder().s("awsKmsEcdhKeyringItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("awsKmsEcdhKeyringItem"))
+        .build()
     );
     keyToGet.put("sort_key", AttributeValue.builder().n("0").build());
 

Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/keyring/KmsRsaKeyringExample.java

@@ -29,6 +29,7 @@
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTableEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTablesEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.structuredencryption.model.CryptoAction;
+import software.amazon.cryptography.examples.ExampleUtils;
 import software.amazon.cryptography.materialproviders.IKeyring;
 import software.amazon.cryptography.materialproviders.MaterialProviders;
 import software.amazon.cryptography.materialproviders.model.CreateAwsKmsRsaKeyringInput;
@@ -201,7 +202,10 @@ public static void KmsRsaKeyringGetItemPutItem(
     final HashMap<String, AttributeValue> item = new HashMap<>();
     item.put(
       "partition_key",
-      AttributeValue.builder().s("awsKmsRsaKeyringItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("awsKmsRsaKeyringItem"))
+        .build()
     );
     item.put("sort_key", AttributeValue.builder().n("0").build());
     item.put(
@@ -226,7 +230,10 @@ public static void KmsRsaKeyringGetItemPutItem(
     final HashMap<String, AttributeValue> keyToGet = new HashMap<>();
     keyToGet.put(
       "partition_key",
-      AttributeValue.builder().s("awsKmsRsaKeyringItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("awsKmsRsaKeyringItem"))
+        .build()
     );
     keyToGet.put("sort_key", AttributeValue.builder().n("0").build());
 

Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/keyring/MrkDiscoveryMultiKeyringExample.java

@@ -16,6 +16,7 @@
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTableEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.dynamodb.model.DynamoDbTablesEncryptionConfig;
 import software.amazon.cryptography.dbencryptionsdk.structuredencryption.model.CryptoAction;
+import software.amazon.cryptography.examples.ExampleUtils;
 import software.amazon.cryptography.materialproviders.IKeyring;
 import software.amazon.cryptography.materialproviders.MaterialProviders;
 import software.amazon.cryptography.materialproviders.model.CreateAwsKmsMrkDiscoveryMultiKeyringInput;
@@ -157,7 +158,10 @@ public static void MultiMrkDiscoveryKeyringGetItemPutItem(
     final HashMap<String, AttributeValue> item = new HashMap<>();
     item.put(
       "partition_key",
-      AttributeValue.builder().s("awsKmsMrkDiscoveryMultiKeyringItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("awsKmsMrkDiscoveryMultiKeyringItem"))
+        .build()
     );
     item.put("sort_key", AttributeValue.builder().n("0").build());
     item.put(
@@ -250,7 +254,10 @@ public static void MultiMrkDiscoveryKeyringGetItemPutItem(
     final HashMap<String, AttributeValue> keyToGet = new HashMap<>();
     keyToGet.put(
       "partition_key",
-      AttributeValue.builder().s("awsKmsMrkDiscoveryMultiKeyringItem").build()
+      AttributeValue
+        .builder()
+        .s(ExampleUtils.uniquePk("awsKmsMrkDiscoveryMultiKeyringItem"))
+        .build()
     );
     keyToGet.put("sort_key", AttributeValue.builder().n("0").build());