diff --git a/sdk1/src/main/java/com/amazonaws/services/dynamodbv2/datamodeling/encryption/providers/DirectKmsMaterialProvider.java b/sdk1/src/main/java/com/amazonaws/services/dynamodbv2/datamodeling/encryption/providers/DirectKmsMaterialProvider.java
index f732c12b..b7a7865e 100644
--- a/sdk1/src/main/java/com/amazonaws/services/dynamodbv2/datamodeling/encryption/providers/DirectKmsMaterialProvider.java
+++ b/sdk1/src/main/java/com/amazonaws/services/dynamodbv2/datamodeling/encryption/providers/DirectKmsMaterialProvider.java
@@ -254,7 +254,8 @@ protected GenerateDataKeyResult generateDataKey(final GenerateDataKeyRequest req
/**
* Extracts relevant information from {@code context} and uses it to populate fields in
- * {@code kmsEc}. Currently, these fields are:
+ * {@code kmsEc}. Subclass can override the default implementation to provide an alternative
+ * encryption context in calls to KMS. Currently, the default implementation includes these fields:
*
* - {@code HashKeyName}
* - {@code HashKeyValue}
@@ -263,7 +264,7 @@ protected GenerateDataKeyResult generateDataKey(final GenerateDataKeyRequest req
* - {@link #TABLE_NAME_EC_KEY}
* - {@code TableName}
*/
- private static void populateKmsEcFromEc(EncryptionContext context, Map kmsEc) {
+ protected void populateKmsEcFromEc(EncryptionContext context, Map kmsEc) {
final String hashKeyName = context.getHashKeyName();
if (hashKeyName != null) {
final AttributeValue hashKey = context.getAttributeValues().get(hashKeyName);
diff --git a/sdk2/src/main/java/software/amazon/cryptools/dynamodbencryptionclientsdk2/encryption/providers/DirectKmsMaterialsProvider.java b/sdk2/src/main/java/software/amazon/cryptools/dynamodbencryptionclientsdk2/encryption/providers/DirectKmsMaterialsProvider.java
index 425a4119..ab402cbb 100644
--- a/sdk2/src/main/java/software/amazon/cryptools/dynamodbencryptionclientsdk2/encryption/providers/DirectKmsMaterialsProvider.java
+++ b/sdk2/src/main/java/software/amazon/cryptools/dynamodbencryptionclientsdk2/encryption/providers/DirectKmsMaterialsProvider.java
@@ -246,7 +246,8 @@ protected GenerateDataKeyResponse generateDataKey(final GenerateDataKeyRequest r
/**
* Extracts relevant information from {@code context} and uses it to populate fields in
- * {@code kmsEc}. Currently, these fields are:
+ * {@code kmsEc}. Subclass can override the default implementation to provide an alternative
+ * encryption context in calls to KMS. Currently, the default implementation includes these fields:
*
* - {@code HashKeyName}
* - {@code HashKeyValue}
@@ -255,7 +256,7 @@ protected GenerateDataKeyResponse generateDataKey(final GenerateDataKeyRequest r
* - {@link #TABLE_NAME_EC_KEY}
* - {@code TableName}
*/
- private static void populateKmsEcFromEc(EncryptionContext context, Map kmsEc) {
+ protected void populateKmsEcFromEc(EncryptionContext context, Map kmsEc) {
final String hashKeyName = context.getHashKeyName();
if (hashKeyName != null) {
final AttributeValue hashKey = context.getAttributeValues().get(hashKeyName);