Skip to content

Commit 0dcf93b

Browse files
lucasmcdonald3lucasmcdonald3
committed
cleanup
1 parent 9b06e3f commit 0dcf93b

20 files changed

+101
-64
lines changed

‎examples/src/aws_kms_discovery_keyring_example.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,7 @@ def encrypt_and_decrypt_with_keyring(
156156
plaintext_bytes, _ = client.decrypt(
157157
source=ciphertext,
158158
keyring=discovery_keyring,
159-
# Verify that the encryption context in the result contains the
160-
# encryption context supplied to the encrypt method
159+
# Provide the encryption context that was supplied to the encrypt method
161160
encryption_context=encryption_context,
162161
)
163162

‎examples/src/aws_kms_discovery_multi_keyring_example.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,7 @@ def encrypt_and_decrypt_with_keyring(
154154
plaintext_bytes, _ = client.decrypt(
155155
source=ciphertext,
156156
keyring=discovery_multi_keyring,
157-
# Verify that the encryption context in the result contains the
158-
# encryption context supplied to the encrypt method
157+
# Provide the encryption context that was supplied to the encrypt method
159158
encryption_context=encryption_context,
160159
)
161160

‎examples/src/aws_kms_keyring_example.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,8 +100,7 @@ def encrypt_and_decrypt_with_keyring(
100100
plaintext_bytes, _ = client.decrypt(
101101
source=ciphertext,
102102
keyring=kms_keyring,
103-
# Verify that the encryption context in the result contains the
104-
# encryption context supplied to the encrypt method
103+
# Provide the encryption context that was supplied to the encrypt method
105104
encryption_context=encryption_context,
106105
)
107106

‎examples/src/aws_kms_mrk_discovery_keyring_example.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,8 +166,7 @@ def encrypt_and_decrypt_with_keyring(
166166
plaintext_bytes, _ = client.decrypt(
167167
source=ciphertext,
168168
keyring=decrypt_discovery_keyring,
169-
# Verify that the encryption context in the result contains the
170-
# encryption context supplied to the encrypt method
169+
# Provide the encryption context that was supplied to the encrypt method
171170
encryption_context=encryption_context,
172171
)
173172

‎examples/src/aws_kms_mrk_discovery_multi_keyring_example.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -175,8 +175,7 @@ def encrypt_and_decrypt_with_keyring(
175175
plaintext_bytes, _ = client.decrypt(
176176
source=ciphertext,
177177
keyring=decrypt_discovery_keyring,
178-
# Verify that the encryption context in the result contains the
179-
# encryption context supplied to the encrypt method
178+
# Provide the encryption context that was supplied to the encrypt method
180179
encryption_context=encryption_context,
181180
)
182181

‎examples/src/aws_kms_mrk_keyring_example.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -135,8 +135,7 @@ def encrypt_and_decrypt_with_keyring(
135135
plaintext_bytes, _ = client.decrypt(
136136
source=ciphertext,
137137
keyring=decrypt_keyring,
138-
# Verify that the encryption context in the result contains the
139-
# encryption context supplied to the encrypt method
138+
# Provide the encryption context that was supplied to the encrypt method
140139
encryption_context=encryption_context,
141140
)
142141

‎examples/src/aws_kms_mrk_multi_keyring_example.py

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -127,8 +127,7 @@ def encrypt_and_decrypt_with_keyring(
127127
plaintext_bytes, _ = client.decrypt(
128128
source=ciphertext,
129129
keyring=kms_mrk_multi_keyring,
130-
# Verify that the encryption context in the result contains the
131-
# encryption context supplied to the encrypt method
130+
# Provide the encryption context that was supplied to the encrypt method
132131
encryption_context=encryption_context,
133132
)
134133

@@ -159,8 +158,7 @@ def encrypt_and_decrypt_with_keyring(
159158
plaintext_bytes_second_region, _ = client.decrypt(
160159
source=ciphertext,
161160
keyring=second_region_mrk_keyring,
162-
# Verify that the encryption context in the result contains the
163-
# encryption context supplied to the encrypt method
161+
# Provide the encryption context that was supplied to the encrypt method
164162
encryption_context=encryption_context,
165163
)
166164

‎examples/src/aws_kms_multi_keyring_example.py

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -134,8 +134,7 @@ def encrypt_and_decrypt_with_keyring(
134134
plaintext_bytes_multi_keyring, _ = client.decrypt(
135135
source=ciphertext,
136136
keyring=kms_multi_keyring,
137-
# Verify that the encryption context in the result contains the
138-
# encryption context supplied to the encrypt method
137+
# Provide the encryption context that was supplied to the encrypt method
139138
encryption_context=encryption_context,
140139
)
141140

@@ -168,8 +167,7 @@ def encrypt_and_decrypt_with_keyring(
168167
plaintext_bytes_default_region_kms_keyring, _ = client.decrypt(
169168
source=ciphertext,
170169
keyring=default_region_kms_keyring,
171-
# Verify that the encryption context in the result contains the
172-
# encryption context supplied to the encrypt method
170+
# Provide the encryption context that was supplied to the encrypt method
173171
encryption_context=encryption_context,
174172
)
175173

@@ -199,8 +197,7 @@ def encrypt_and_decrypt_with_keyring(
199197
plaintext_bytes_second_region_kms_keyring, _ = client.decrypt(
200198
source=ciphertext,
201199
keyring=second_region_kms_keyring,
202-
# Verify that the encryption context in the result contains the
203-
# encryption context supplied to the encrypt method
200+
# Provide the encryption context that was supplied to the encrypt method
204201
encryption_context=encryption_context,
205202
)
206203

‎examples/src/aws_kms_rsa_keyring_example.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,7 @@ def encrypt_and_decrypt_with_keyring(
106106
plaintext_bytes, _ = client.decrypt(
107107
source=ciphertext,
108108
keyring=kms_rsa_keyring,
109-
# Verify that the encryption context in the result contains the
110-
# encryption context supplied to the encrypt method
109+
# Provide the encryption context that was supplied to the encrypt method
111110
encryption_context=encryption_context,
112111
)
113112

‎examples/src/default_cryptographic_materials_manager_example.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,7 @@ def encrypt_and_decrypt_with_default_cmm(
112112
plaintext_bytes, _ = client.decrypt(
113113
source=ciphertext,
114114
materials_manager=cmm,
115-
# Verify that the encryption context in the result contains the
116-
# encryption context supplied to the encrypt method
115+
# Provide the encryption context that was supplied to the encrypt method
117116
encryption_context=encryption_context,
118117
)
119118

‎examples/src/hierarchical_keyring_example.py

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -226,8 +226,7 @@ def encrypt_and_decrypt_with_keyring(
226226
plaintext_bytes_a, _ = client.decrypt(
227227
source=ciphertext_a,
228228
keyring=hierarchical_keyring_a,
229-
# Verify that the encryption context in the result contains the
230-
# encryption context supplied to the encrypt method
229+
# Provide the encryption context that was supplied to the encrypt method
231230
encryption_context=encryption_context_a,
232231
)
233232
assert plaintext_bytes_a == EXAMPLE_DATA, \
@@ -236,8 +235,7 @@ def encrypt_and_decrypt_with_keyring(
236235
plaintext_bytes_b, _ = client.decrypt(
237236
source=ciphertext_b,
238237
keyring=hierarchical_keyring_b,
239-
# Verify that the encryption context in the result contains the
240-
# encryption context supplied to the encrypt method
238+
# Provide the encryption context that was supplied to the encrypt method
241239
encryption_context=encryption_context_b,
242240
)
243241
assert plaintext_bytes_b == EXAMPLE_DATA, \

‎examples/src/migration/migration_aws_kms_key_example.py

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -115,14 +115,14 @@ def migration_aws_kms_key(
115115
aws_kms_master_key_provider = create_key_provider(kms_key_id=kms_key_id)
116116

117117
# 2a. Encrypt EXAMPLE_DATA using AWS KMS Keyring
118-
ciphertext_keyring, _ = client.encrypt(
118+
ciphertext_keyring, enc_header_keyring = client.encrypt(
119119
source=EXAMPLE_DATA,
120120
keyring=aws_kms_keyring,
121121
encryption_context=DEFAULT_ENCRYPTION_CONTEXT
122122
)
123123

124124
# 2b. Encrypt EXAMPLE_DATA using AWS KMS Master Key Provider
125-
ciphertext_mkp, _ = client.encrypt(
125+
ciphertext_mkp, enc_header_mkp = client.encrypt(
126126
source=EXAMPLE_DATA,
127127
key_provider=aws_kms_master_key_provider,
128128
encryption_context=DEFAULT_ENCRYPTION_CONTEXT
@@ -137,14 +137,24 @@ def migration_aws_kms_key(
137137
# resulting plaintext is the same and also equal to EXAMPLE_DATA
138138
decrypted_ciphertext_keyring_using_keyring, _ = client.decrypt(
139139
source=ciphertext_keyring,
140-
keyring=aws_kms_keyring
140+
keyring=aws_kms_keyring,
141+
# Provide the encryption context that was supplied to the encrypt method
142+
encryption_context=DEFAULT_ENCRYPTION_CONTEXT,
141143
)
142144

143-
decrypted_ciphertext_keyring_using_mkp, _ = client.decrypt(
145+
decrypted_ciphertext_keyring_using_mkp, decrypted_header_keyring_using_mkp = client.decrypt(
144146
source=ciphertext_keyring,
145147
key_provider=aws_kms_master_key_provider
146148
)
147149

150+
# Legacy MasterKeyProviders do not support providing encryption context on decrypt.
151+
# If decrypting with a legacy MasterKeyProvider, you should manually verify
152+
# that the encryption context used in the decrypt operation
153+
# includes all key pairs from the encrypt operation. (The SDK can add pairs, so don't require an exact match.)
154+
assert all(
155+
pair in decrypted_header_keyring_using_mkp.encryption_context.items() for pair in enc_header_keyring.encryption_context.items()
156+
)
157+
148158
assert decrypted_ciphertext_keyring_using_keyring == decrypted_ciphertext_keyring_using_mkp \
149159
and decrypted_ciphertext_keyring_using_keyring == EXAMPLE_DATA, \
150160
"Decrypted outputs using keyring and master key provider are not the same"
@@ -153,14 +163,24 @@ def migration_aws_kms_key(
153163
# resulting plaintext is the same and also equal to EXAMPLE_DATA
154164
decrypted_ciphertext_mkp_using_keyring, _ = client.decrypt(
155165
source=ciphertext_mkp,
156-
keyring=aws_kms_keyring
166+
keyring=aws_kms_keyring,
167+
# Provide the encryption context that was supplied to the encrypt method
168+
encryption_context=DEFAULT_ENCRYPTION_CONTEXT,
157169
)
158170

159-
decrypted_ciphertext_mkp_using_mkp, _ = client.decrypt(
171+
decrypted_ciphertext_mkp_using_mkp, decrypted_header_mkp_using_mkp = client.decrypt(
160172
source=ciphertext_mkp,
161173
key_provider=aws_kms_master_key_provider
162174
)
163175

176+
# Legacy MasterKeyProviders do not support providing encryption context on decrypt.
177+
# If decrypting with a legacy MasterKeyProvider, you should manually verify
178+
# that the encryption context used in the decrypt operation
179+
# includes all key pairs from the encrypt operation. (The SDK can add pairs, so don't require an exact match.)
180+
assert all(
181+
pair in decrypted_header_mkp_using_mkp.encryption_context.items() for pair in enc_header_mkp.encryption_context.items()
182+
)
183+
164184
assert decrypted_ciphertext_mkp_using_keyring == decrypted_ciphertext_mkp_using_mkp \
165185
and decrypted_ciphertext_mkp_using_keyring == EXAMPLE_DATA, \
166186
"Decrypted outputs using keyring and master key provider are not the same"

‎examples/src/migration/migration_raw_aes_key_example.py

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -156,14 +156,14 @@ def migration_raw_aes_key():
156156
raw_aes_master_key_provider = create_key_provider()
157157

158158
# 2a. Encrypt EXAMPLE_DATA using Raw AES Keyring
159-
ciphertext_keyring, _ = client.encrypt(
159+
ciphertext_keyring, enc_header_keyring = client.encrypt(
160160
source=EXAMPLE_DATA,
161161
keyring=raw_aes_keyring,
162162
encryption_context=DEFAULT_ENCRYPTION_CONTEXT
163163
)
164164

165165
# 2b. Encrypt EXAMPLE_DATA using Raw AES Master Key Provider
166-
ciphertext_mkp, _ = client.encrypt(
166+
ciphertext_mkp, enc_header_mkp = client.encrypt(
167167
source=EXAMPLE_DATA,
168168
key_provider=raw_aes_master_key_provider,
169169
encryption_context=DEFAULT_ENCRYPTION_CONTEXT
@@ -178,14 +178,24 @@ def migration_raw_aes_key():
178178
# resulting plaintext is the same and also equal to EXAMPLE_DATA
179179
decrypted_ciphertext_keyring_using_keyring, _ = client.decrypt(
180180
source=ciphertext_keyring,
181-
keyring=raw_aes_keyring
181+
keyring=raw_aes_keyring,
182+
# Provide the encryption context that was supplied to the encrypt method
183+
encryption_context=DEFAULT_ENCRYPTION_CONTEXT,
182184
)
183185

184-
decrypted_ciphertext_keyring_using_mkp, _ = client.decrypt(
186+
decrypted_ciphertext_keyring_using_mkp, decrypted_header_keyring_using_mkp = client.decrypt(
185187
source=ciphertext_keyring,
186188
key_provider=raw_aes_master_key_provider
187189
)
188190

191+
# Legacy MasterKeyProviders do not support providing encryption context on decrypt.
192+
# If decrypting with a legacy MasterKeyProvider, you should manually verify
193+
# that the encryption context used in the decrypt operation
194+
# includes all key pairs from the encrypt operation. (The SDK can add pairs, so don't require an exact match.)
195+
assert all(
196+
pair in decrypted_header_keyring_using_mkp.encryption_context.items() for pair in enc_header_keyring.encryption_context.items()
197+
)
198+
189199
assert decrypted_ciphertext_keyring_using_keyring == decrypted_ciphertext_keyring_using_mkp \
190200
and decrypted_ciphertext_keyring_using_keyring == EXAMPLE_DATA, \
191201
"Decrypted outputs using keyring and master key provider are not the same"
@@ -194,14 +204,24 @@ def migration_raw_aes_key():
194204
# resulting plaintext is the same and also equal to EXAMPLE_DATA
195205
decrypted_ciphertext_mkp_using_keyring, _ = client.decrypt(
196206
source=ciphertext_mkp,
197-
keyring=raw_aes_keyring
207+
keyring=raw_aes_keyring,
208+
# Provide the encryption context that was supplied to the encrypt method
209+
encryption_context=DEFAULT_ENCRYPTION_CONTEXT,
198210
)
199211

200-
decrypted_ciphertext_mkp_using_mkp, _ = client.decrypt(
212+
decrypted_ciphertext_mkp_using_mkp, decrypted_header_mkp_using_mkp = client.decrypt(
201213
source=ciphertext_mkp,
202214
key_provider=raw_aes_master_key_provider
203215
)
204216

217+
# Legacy MasterKeyProviders do not support providing encryption context on decrypt.
218+
# If decrypting with a legacy MasterKeyProvider, you should manually verify
219+
# that the encryption context used in the decrypt operation
220+
# includes all key pairs from the encrypt operation. (The SDK can add pairs, so don't require an exact match.)
221+
assert all(
222+
pair in decrypted_header_mkp_using_mkp.encryption_context.items() for pair in enc_header_mkp.encryption_context.items()
223+
)
224+
205225
assert decrypted_ciphertext_mkp_using_keyring == decrypted_ciphertext_mkp_using_mkp \
206226
and decrypted_ciphertext_mkp_using_keyring == EXAMPLE_DATA, \
207227
"Decrypted outputs using keyring and master key provider are not the same"

‎examples/src/migration/migration_raw_rsa_key_example.py

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -208,14 +208,14 @@ def migration_raw_rsa_key(
208208
raw_rsa_master_key_provider = create_key_provider()
209209

210210
# 2a. Encrypt EXAMPLE_DATA using Raw RSA Keyring
211-
ciphertext_keyring, _ = client.encrypt(
211+
ciphertext_keyring, enc_header_keyring = client.encrypt(
212212
source=EXAMPLE_DATA,
213213
keyring=raw_rsa_keyring,
214214
encryption_context=DEFAULT_ENCRYPTION_CONTEXT
215215
)
216216

217217
# 2b. Encrypt EXAMPLE_DATA using Raw RSA Master Key Provider
218-
ciphertext_mkp, _ = client.encrypt(
218+
ciphertext_mkp, enc_header_mkp = client.encrypt(
219219
source=EXAMPLE_DATA,
220220
key_provider=raw_rsa_master_key_provider,
221221
encryption_context=DEFAULT_ENCRYPTION_CONTEXT
@@ -230,14 +230,24 @@ def migration_raw_rsa_key(
230230
# resulting plaintext is the same and also equal to EXAMPLE_DATA
231231
decrypted_ciphertext_keyring_using_keyring, _ = client.decrypt(
232232
source=ciphertext_keyring,
233-
keyring=raw_rsa_keyring
233+
keyring=raw_rsa_keyring,
234+
# Provide the encryption context that was supplied to the encrypt method
235+
encryption_context=DEFAULT_ENCRYPTION_CONTEXT,
234236
)
235237

236-
decrypted_ciphertext_keyring_using_mkp, _ = client.decrypt(
238+
decrypted_ciphertext_keyring_using_mkp, decrypted_header_keyring_using_mkp = client.decrypt(
237239
source=ciphertext_keyring,
238240
key_provider=raw_rsa_master_key_provider
239241
)
240242

243+
# Legacy MasterKeyProviders do not support providing encryption context on decrypt.
244+
# If decrypting with a legacy MasterKeyProvider, you should manually verify
245+
# that the encryption context used in the decrypt operation
246+
# includes all key pairs from the encrypt operation. (The SDK can add pairs, so don't require an exact match.)
247+
assert all(
248+
pair in decrypted_header_keyring_using_mkp.encryption_context.items() for pair in enc_header_keyring.encryption_context.items()
249+
)
250+
241251
assert decrypted_ciphertext_keyring_using_keyring == decrypted_ciphertext_keyring_using_mkp \
242252
and decrypted_ciphertext_keyring_using_keyring == EXAMPLE_DATA, \
243253
"Decrypted outputs using keyring and master key provider are not the same"
@@ -246,14 +256,24 @@ def migration_raw_rsa_key(
246256
# resulting plaintext is the same and also equal to EXAMPLE_DATA
247257
decrypted_ciphertext_mkp_using_keyring, _ = client.decrypt(
248258
source=ciphertext_mkp,
249-
keyring=raw_rsa_keyring
259+
keyring=raw_rsa_keyring,
260+
# Provide the encryption context that was supplied to the encrypt method
261+
encryption_context=DEFAULT_ENCRYPTION_CONTEXT,
250262
)
251263

252-
decrypted_ciphertext_mkp_using_mkp, _ = client.decrypt(
264+
decrypted_ciphertext_mkp_using_mkp, decrypted_header_mkp_using_mkp = client.decrypt(
253265
source=ciphertext_mkp,
254266
key_provider=raw_rsa_master_key_provider
255267
)
256268

269+
# Legacy MasterKeyProviders do not support providing encryption context on decrypt.
270+
# If decrypting with a legacy MasterKeyProvider, you should manually verify
271+
# that the encryption context used in the decrypt operation
272+
# includes all key pairs from the encrypt operation. (The SDK can add pairs, so don't require an exact match.)
273+
assert all(
274+
pair in decrypted_header_mkp_using_mkp.encryption_context.items() for pair in enc_header_mkp.encryption_context.items()
275+
)
276+
257277
assert decrypted_ciphertext_mkp_using_keyring == decrypted_ciphertext_mkp_using_mkp \
258278
and decrypted_ciphertext_mkp_using_keyring == EXAMPLE_DATA, \
259279
"Decrypted outputs using keyring and master key provider are not the same"

‎examples/src/migration/migration_set_commitment_policy_example.py

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,8 +108,7 @@ def encrypt_and_decrypt_with_keyring(
108108
plaintext_bytes, _ = client.decrypt(
109109
source=ciphertext,
110110
keyring=kms_keyring,
111-
# Verify that the encryption context in the result contains the
112-
# encryption context supplied to the encrypt method
111+
# Provide the encryption context that was supplied to the encrypt method
113112
encryption_context=encryption_context,
114113
)
115114

0 commit comments

Comments
 (0)