Skip to content

chore: Clarify StrictAwsKmsMasterKeyProvider docs #316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jan 27, 2021
Merged

chore: Clarify StrictAwsKmsMasterKeyProvider docs #316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ea50c73
chore: Clarify StrictAwsKmsMasterKeyProvider docs
lavaleri Jan 15, 2021
4364b4e
PR feedback
lavaleri Jan 27, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,11 @@ StrictAwsKmsMasterKeyProvider
A ``StrictAwsKmsMasterKeyProvider`` is configured with an explicit list of AWS KMS
CMKs with which to encrypt and decrypt data. On encryption, it encrypts the plaintext with all
configured CMKs. On decryption, it only attempts to decrypt ciphertexts that have been wrapped
with one of the configured CMKs.
with a CMK that matches one of the configured CMK ARNs.

To create a ``StrictAwsKmsMasterKeyProvider`` you must provide one or more CMKs. For providers that will only
be used for encryption, you can use any valid `KMS key identifier`_. For providers that will be used for decryption, you
must use the key ARN; key ids, alias names, and alias ARNs are not supported.

Because the ``StrictAwsKmsMasterKeyProvider`` uses the `boto3 SDK`_ to interact with `AWS KMS`_,
it requires AWS Credentials.
Expand All @@ -125,10 +129,6 @@ pre-existing instance of a ``botocore session`` to the ``StrictAwsKmsMasterKeyPr
This latter option can be useful if you have an alternate way to store your AWS credentials or
you want to reuse an existing instance of a botocore session in order to decrease startup costs.

To create a ``StrictAwsKmsMasterKeyProvider`` you must provide one or more CMKs. For providers that will only
be used for encryption, you can use any valid `KMS key identifier`_. For providers that will be used for decryption, you
must use the key ARN; key ids, alias names, and alias ARNs are not supported.

If you configure the the ``StrictAwsKmsMasterKeyProvider`` with multiple CMKs, the `final message`_
will include a copy of the data key encrypted by each configured CMK.

Expand Down
10 changes: 7 additions & 3 deletions src/aws_encryption_sdk/key_providers/kms.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,9 +228,13 @@ def _new_master_key(self, key_id):

class StrictAwsKmsMasterKeyProvider(BaseKMSMasterKeyProvider):
"""Strict Master Key Provider for KMS. It is configured with an explicit list of AWS KMS master keys that
should be used for encryption in decryption. On encryption, the plaintext will be encrypted with all configured
master keys. On decryption, the ciphertext will be decrypted with the first master key that can decrypt. If the
ciphertext is encrypted with a master key that was not explicitly configured, decryption will fail.
should be used for encryption and decryption. On encryption, the plaintext will be encrypted with all configured
master keys. On decryption, it only attempts to decrypt ciphertexts that have been wrapped with a CMK that
matches one of the configured CMK ARNs. If the ciphertext is encrypted with a master key that was not
explicitly configured, decryption will fail. To create a StrictAwsKmsMasterKeyProvider you must provide
one or more CMKs. For providers that will only be used for encryption, you can use any valid KMS key
identifier. For providers that will be used for decryption, you must use the key ARN; key ids, alias names, and
alias ARNs are not supported.

>>> import aws_encryption_sdk
>>> kms_key_provider = aws_encryption_sdk.StrictAwsKmsMasterKeyProvider(key_ids=[
Expand Down