Skip to content

Commit 39d4498

Browse files
RitvikKapilaRitvikKapila
authored
chore(performance_tests): added hierarchy keyring and caching cmm tests (#686)
1 parent ebbc26b commit 39d4498

20 files changed

+588
-21
lines changed

‎performance_tests/src/aws_encryption_sdk_performance_tests/keyrings/hierarchy_keyring.py

+128
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
"""Performance tests for the hierarchy keyring."""
4+
5+
import aws_encryption_sdk
6+
import boto3
7+
from aws_cryptographic_materialproviders.keystore import KeyStore
8+
from aws_cryptographic_materialproviders.keystore.config import KeyStoreConfig
9+
from aws_cryptographic_materialproviders.keystore.models import KMSConfigurationKmsKeyArn
10+
from aws_cryptographic_materialproviders.mpl import AwsCryptographicMaterialProviders
11+
from aws_cryptographic_materialproviders.mpl.config import MaterialProvidersConfig
12+
from aws_cryptographic_materialproviders.mpl.models import (
13+
CacheTypeDefault,
14+
CreateAwsKmsHierarchicalKeyringInput,
15+
DefaultCache,
16+
)
17+
from aws_cryptographic_materialproviders.mpl.references import IKeyring
18+
19+
from ..utils.util import PerfTestUtils
20+
21+
22+
def create_keyring(
23+
key_store_table_name: str,
24+
logical_key_store_name: str,
25+
kms_key_id: str,
26+
branch_key_id: str = PerfTestUtils.DEFAULT_BRANCH_KEY_ID
27+
):
28+
"""Demonstrate how to create a hierarchy keyring.
29+
30+
Usage: create_keyring(key_store_table_name, logical_key_store_name, kms_key_id, branch_key_id)
31+
:param key_store_table_name: Name of the KeyStore DynamoDB table.
32+
:type key_store_table_name: string
33+
:param logical_key_store_name: Logical name of the KeyStore.
34+
:type logical_key_store_name: string
35+
:param kms_key_id: KMS Key identifier for the KMS key you want to use.
36+
:type kms_key_id: string
37+
:param branch_key_id: Branch key you want to use for the hierarchy keyring.
38+
:type branch_key_id: string
39+
40+
For more information on KMS Key identifiers, see
41+
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id
42+
"""
43+
# Create boto3 clients for DynamoDB and KMS.
44+
ddb_client = boto3.client('dynamodb', region_name="us-west-2")
45+
kms_client = boto3.client('kms', region_name="us-west-2")
46+
47+
# Configure your KeyStore resource.
48+
# This SHOULD be the same configuration that you used
49+
# to initially create and populate your KeyStore.
50+
keystore: KeyStore = KeyStore(
51+
config=KeyStoreConfig(
52+
ddb_client=ddb_client,
53+
ddb_table_name=key_store_table_name,
54+
logical_key_store_name=logical_key_store_name,
55+
kms_client=kms_client,
56+
kms_configuration=KMSConfigurationKmsKeyArn(
57+
value=kms_key_id
58+
),
59+
)
60+
)
61+
62+
# Create the Hierarchical Keyring.
63+
mat_prov: AwsCryptographicMaterialProviders = AwsCryptographicMaterialProviders(
64+
config=MaterialProvidersConfig()
65+
)
66+
67+
keyring_input: CreateAwsKmsHierarchicalKeyringInput = CreateAwsKmsHierarchicalKeyringInput(
68+
key_store=keystore,
69+
branch_key_id=branch_key_id,
70+
ttl_seconds=600,
71+
cache=CacheTypeDefault(
72+
value=DefaultCache(
73+
entry_capacity=100
74+
)
75+
),
76+
)
77+
78+
keyring: IKeyring = mat_prov.create_aws_kms_hierarchical_keyring(
79+
input=keyring_input
80+
)
81+
82+
return keyring
83+
84+
85+
def encrypt_using_keyring(
86+
plaintext_data: bytes,
87+
keyring: IKeyring
88+
):
89+
"""Demonstrate how to encrypt plaintext data using a hierarchy keyring.
90+
91+
Usage: encrypt_using_keyring(plaintext_data, keyring)
92+
:param plaintext_data: plaintext data you want to encrypt
93+
:type: bytes
94+
:param keyring: Keyring to use for encryption.
95+
:type keyring: IKeyring
96+
"""
97+
client = aws_encryption_sdk.EncryptionSDKClient()
98+
99+
ciphertext_data, _ = client.encrypt(
100+
source=plaintext_data,
101+
keyring=keyring,
102+
encryption_context=PerfTestUtils.DEFAULT_ENCRYPTION_CONTEXT
103+
)
104+
105+
return ciphertext_data
106+
107+
108+
def decrypt_using_keyring(
109+
ciphertext_data: bytes,
110+
keyring: IKeyring
111+
):
112+
"""Demonstrate how to decrypt ciphertext data using a hierarchy keyring.
113+
114+
Usage: decrypt_using_keyring(ciphertext_data, keyring)
115+
:param ciphertext_data: ciphertext data you want to decrypt
116+
:type: bytes
117+
:param keyring: Keyring to use for decryption.
118+
:type keyring: IKeyring
119+
"""
120+
client = aws_encryption_sdk.EncryptionSDKClient()
121+
122+
decrypted_plaintext_data, _ = client.decrypt(
123+
source=ciphertext_data,
124+
keyring=keyring,
125+
encryption_context=PerfTestUtils.DEFAULT_ENCRYPTION_CONTEXT
126+
)
127+
128+
return decrypted_plaintext_data

‎performance_tests/src/aws_encryption_sdk_performance_tests/keyrings/raw_aes_keyring.py

-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ def create_keyring():
1919
key_name_space = "Some managed raw keys"
2020
key_name = "My 256-bit AES wrapping key"
2121

22-
# Here, the input to secrets.token_bytes() = 32 bytes = 256 bits
2322
# We fix the static key in order to make the test deterministic
2423
static_key = PerfTestUtils.DEFAULT_AES_256_STATIC_KEY
2524

‎performance_tests/src/aws_encryption_sdk_performance_tests/master_key_providers/aws_kms_master_key_provider.py

+4-4
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
def create_key_provider(
99
kms_key_id: str
1010
):
11-
"""Demonstrate how to create an AWS KMS master key-provider.
11+
"""Demonstrate how to create an AWS KMS master key provider.
1212
1313
Usage: create_key_provider(kms_key_id)
1414
:param kms_key_id: KMS Key identifier for the KMS key you want to use.
@@ -17,7 +17,7 @@ def create_key_provider(
1717
For more information on KMS Key identifiers, see
1818
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id
1919
"""
20-
# Create a KMS master key-provider.
20+
# Create a KMS master key provider.
2121
key_provider = aws_encryption_sdk.StrictAwsKmsMasterKeyProvider(key_ids=[
2222
kms_key_id,
2323
])
@@ -29,7 +29,7 @@ def encrypt_using_key_provider(
2929
plaintext_data: bytes,
3030
key_provider: aws_encryption_sdk.key_providers.base.MasterKeyProvider
3131
):
32-
"""Demonstrate how to encrypt plaintext data using an AWS KMS master key-provider.
32+
"""Demonstrate how to encrypt plaintext data using an AWS KMS master key provider.
3333
3434
Usage: encrypt_using_key_provider(plaintext_data, key_provider)
3535
:param plaintext_data: plaintext data you want to encrypt
@@ -51,7 +51,7 @@ def decrypt_using_key_provider(
5151
ciphertext_data: bytes,
5252
key_provider: aws_encryption_sdk.key_providers.base.MasterKeyProvider
5353
):
54-
"""Demonstrate how to decrypt ciphertext data using an AWS KMS master key-provider.
54+
"""Demonstrate how to decrypt ciphertext data using an AWS KMS master key provider.
5555
5656
Usage: decrypt_using_key_provider(ciphertext_data, key_provider)
5757
:param ciphertext_data: ciphertext data you want to decrypt

‎performance_tests/src/aws_encryption_sdk_performance_tests/master_key_providers/caching_cmm.py

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
"""Performance tests for the Caching Cryptographic Materials Manager (CMM) with KMS Master Key Provider."""
4+
5+
import aws_encryption_sdk
6+
7+
8+
def create_cmm(
9+
kms_key_id: str,
10+
max_age_in_cache: float,
11+
cache_capacity: int
12+
):
13+
"""Demonstrate how to create a Caching CMM.
14+
15+
Usage: create_cmm(kms_key_id, max_age_in_cache, cache_capacity)
16+
:param kms_key_id: Amazon Resource Name (ARN) of the KMS customer master key
17+
:type kms_key_id: str
18+
:param max_age_in_cache: Maximum time in seconds that a cached entry can be used
19+
:type max_age_in_cache: float
20+
:param cache_capacity: Maximum number of entries to retain in cache at once
21+
:type cache_capacity: int
22+
"""
23+
# Security thresholds
24+
# Max messages (or max bytes per) data key are optional
25+
max_messages_encrypted = 100
26+
27+
# Create a master key provider for the KMS customer master key (CMK)
28+
key_provider = aws_encryption_sdk.StrictAwsKmsMasterKeyProvider(key_ids=[kms_key_id])
29+
30+
# Create a local cache
31+
cache = aws_encryption_sdk.LocalCryptoMaterialsCache(cache_capacity)
32+
33+
# Create a caching CMM
34+
caching_cmm = aws_encryption_sdk.CachingCryptoMaterialsManager(
35+
master_key_provider=key_provider,
36+
cache=cache,
37+
max_age=max_age_in_cache,
38+
max_messages_encrypted=max_messages_encrypted,
39+
)
40+
41+
return caching_cmm
42+
43+
44+
def encrypt_using_cmm(
45+
plaintext_data: bytes,
46+
caching_cmm: aws_encryption_sdk.materials_managers.base.CryptoMaterialsManager
47+
):
48+
"""Demonstrate how to encrypt plaintext data using a Caching CMM.
49+
50+
Usage: encrypt_using_cmm(plaintext_data, caching_cmm)
51+
:param plaintext_data: plaintext data you want to encrypt
52+
:type: bytes
53+
:param caching_cmm: Crypto Materials Manager to use for encryption.
54+
:type caching_cmm: aws_encryption_sdk.materials_managers.base.CryptoMaterialsManager
55+
"""
56+
client = aws_encryption_sdk.EncryptionSDKClient()
57+
58+
ciphertext_data, _ = client.encrypt(
59+
source=plaintext_data,
60+
materials_manager=caching_cmm
61+
)
62+
63+
return ciphertext_data
64+
65+
66+
def decrypt_using_cmm(
67+
ciphertext_data: bytes,
68+
caching_cmm: aws_encryption_sdk.materials_managers.base.CryptoMaterialsManager
69+
):
70+
"""Demonstrate how to decrypt ciphertext data using a Caching CMM.
71+
72+
Usage: decrypt_using_cmm(ciphertext_data, caching_cmm)
73+
:param ciphertext_data: ciphertext data you want to decrypt
74+
:type: bytes
75+
:param caching_cmm: Crypto Materials Manager to use for encryption.
76+
:type caching_cmm: aws_encryption_sdk.materials_managers.base.CryptoMaterialsManager
77+
"""
78+
client = aws_encryption_sdk.EncryptionSDKClient()
79+
80+
decrypted_plaintext_data, _ = client.decrypt(
81+
source=ciphertext_data,
82+
materials_manager=caching_cmm
83+
)
84+
85+
return decrypted_plaintext_data

‎performance_tests/src/aws_encryption_sdk_performance_tests/master_key_providers/raw_aes_master_key_provider.py

+5-5
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,13 @@ def _get_raw_key(self, key_id):
4343

4444

4545
def create_key_provider():
46-
"""Demonstrate how to create a Raw AES master key-provider.
46+
"""Demonstrate how to create a Raw AES master key provider.
4747
4848
Usage: create_key_provider()
4949
"""
50-
# Create a Raw AES master key-provider.
50+
# Create a Raw AES master key provider.
5151

52-
# The Key ID field in the JceMasterKey and RawMasterKey is equivalent to key name in the Raw keyrings
52+
# The Key ID field in the JceMasterKey and RawMasterKey is equivalent to key name in the Raw keyrings
5353
key_id = "My 256-bit AES wrapping key"
5454
key_provider = StaticRandomMasterKeyProvider()
5555
key_provider.add_master_key(key_id)
@@ -61,7 +61,7 @@ def encrypt_using_key_provider(
6161
plaintext_data: bytes,
6262
key_provider: aws_encryption_sdk.key_providers.base.MasterKeyProvider
6363
):
64-
"""Demonstrate how to encrypt plaintext data using a Raw AES master key-provider.
64+
"""Demonstrate how to encrypt plaintext data using a Raw AES master key provider.
6565
6666
Usage: encrypt_using_key_provider(plaintext_data, key_provider)
6767
:param plaintext_data: plaintext data you want to encrypt
@@ -83,7 +83,7 @@ def decrypt_using_key_provider(
8383
ciphertext_data: bytes,
8484
key_provider: aws_encryption_sdk.key_providers.base.MasterKeyProvider
8585
):
86-
"""Demonstrate how to decrypt ciphertext data using a Raw AES master key-provider.
86+
"""Demonstrate how to decrypt ciphertext data using a Raw AES master key provider.
8787
8888
Usage: decrypt_using_key_provider(ciphertext_data, key_provider)
8989
:param ciphertext_data: ciphertext data you want to decrypt

‎performance_tests/src/aws_encryption_sdk_performance_tests/master_key_providers/raw_rsa_master_key_provider.py

+5-5
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,13 @@ def _get_raw_key(self, key_id):
4343

4444

4545
def create_key_provider():
46-
"""Demonstrate how to create a Raw RSA master key-provider.
46+
"""Demonstrate how to create a Raw RSA master key provider.
4747
4848
Usage: create_key_provider()
4949
"""
50-
# Create a Raw RSA master key-provider.
50+
# Create a Raw RSA master key provider.
5151

52-
# The Key ID field in the JceMasterKey and RawMasterKey is equivalent to key name in the Raw keyrings
52+
# The Key ID field in the JceMasterKey and RawMasterKey is equivalent to key name in the Raw keyrings
5353
key_id = "My 4096-bit RSA wrapping key"
5454
key_provider = StaticRandomMasterKeyProvider()
5555
key_provider.add_master_key(key_id)
@@ -61,7 +61,7 @@ def encrypt_using_key_provider(
6161
plaintext_data: bytes,
6262
key_provider: aws_encryption_sdk.key_providers.base.MasterKeyProvider
6363
):
64-
"""Demonstrate how to encrypt plaintext data using a Raw RSA master key-provider.
64+
"""Demonstrate how to encrypt plaintext data using a Raw RSA master key provider.
6565
6666
Usage: encrypt_using_key_provider(plaintext_data, key_provider)
6767
:param plaintext_data: plaintext data you want to encrypt
@@ -83,7 +83,7 @@ def decrypt_using_key_provider(
8383
ciphertext_data: bytes,
8484
key_provider: aws_encryption_sdk.key_providers.base.MasterKeyProvider
8585
):
86-
"""Demonstrate how to decrypt ciphertext data using a Raw RSA master key-provider.
86+
"""Demonstrate how to decrypt ciphertext data using a Raw RSA master key provider.
8787
8888
Usage: decrypt_using_key_provider(ciphertext_data, key_provider)
8989
:param ciphertext_data: ciphertext data you want to decrypt

‎performance_tests/src/aws_encryption_sdk_performance_tests/utils/util.py

+1-3
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,7 @@ class PerfTestUtils:
8787
"the data you are handling": "is what you think it is",
8888
}
8989

90-
DEFAULT_BRANCH_KEY_ID_A = 'a52dfaad-7dbd-4430-a1fd-abaa5299da07'
91-
92-
DEFAULT_BRANCH_KEY_ID_B = '8ba79cef-581c-4125-9292-b057a29d42d7'
90+
DEFAULT_BRANCH_KEY_ID = 'a52dfaad-7dbd-4430-a1fd-abaa5299da07'
9391

9492
@staticmethod
9593
def read_file(filename):

0 commit comments

Comments
 (0)