Skip to content

Commit 1aaa4c5

Browse files
robin-awsseebees
robin-aws
and
seebees
authored
feat: AWS KMS multi-Region Key support (#254)
Added new the master key AwsKmsMrkAwareMasterKey and the new master key provider AwsKmsMrkAwareMasterKeyProvider that support AWS KMS multi-Region Keys. See https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html for more details about AWS KMS multi-Region Keys. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/configure.html#config-mrks for more details about how the AWS Encryption SDK interoperates with AWS KMS multi-Region keys. Co-authored-by: seebees <[email protected]>
1 parent d67fff9 commit 1aaa4c5

File tree

55 files changed

+4915
-133
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+4915
-133
lines changed

‎.gitignore

+4-1
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,7 @@ target/
55
.classpath
66
/bin/
77
.idea/
8-
*.iml
8+
*.iml
9+
/.history
10+
/.DS_Store
11+
/specification_compliance_report.html

‎.gitmodules

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
11
[submodule "src/test/resources/aws-encryption-sdk-test-vectors"]
22
path = src/test/resources/aws-encryption-sdk-test-vectors
33
url = https://github.com/awslabs/private-aws-encryption-sdk-test-vectors-staging.git
4+
[submodule "aws-encryption-sdk-specification"]
5+
path = aws-encryption-sdk-specification
6+
url = https://github.com/awslabs/private-aws-encryption-sdk-specification-staging.git

‎CHANGELOG.md

+15
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,20 @@
11
# Changelog
22

3+
## 2.3.0 -- 2021-06-16
4+
5+
* feat: AWS KMS multi-Region Key support
6+
7+
Added new the master key AwsKmsMrkAwareMasterKey
8+
and the new master key provider AwsKmsMrkAwareMasterKeyProvider
9+
that support AWS KMS multi-Region Keys.
10+
11+
See https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html
12+
for more details about AWS KMS multi-Region Keys.
13+
14+
See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/configure.html#config-mrks
15+
for more details about how the AWS Encryption SDK interoperates
16+
with AWS KMS multi-Region keys.
17+
318
## 2.2.0 -- 2021-05-27
419

520
* feat: Improvements to the message decryption process.

‎NOTICE.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ This software includes third party software subject to the following copyrights:
88
-Cryptographic functions from Bouncy Castle Crypto APIs for Java - Copyright
99
2000-2013 The Legion of the Bouncy Castle
1010

11-
The licenses for these third party components are included in LICENSE.txt
11+
The licenses for these third party components are included in LICENSE.txt

‎README-JML.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -646,4 +646,4 @@ OpenJML distinguishes between an assertion or specification being found to be in
646646

647647
## Where to Find Java Standard Library Specifications
648648

649-
In the installation of OpenJML, the repo OpenJML/Specs (https://github.com/OpenJML/Specs) is downloaded. This contains specifications for a subset of Java's standard library, following the package structure of the JDK. Any missing specifications could be added into files in the projects contained. Note that the specifications provided for standard library classes and methods are assumed, rather than verified against particular implementations, so any added specifications should be carefully examined so as not to introduce potential unsoundness. If appropriate, additional standard library specifications could be merged into the official release of OpenJML by making a pull request to the development branch of OpenJML/Specs.
649+
In the installation of OpenJML, the repo OpenJML/Specs (https://github.com/OpenJML/Specs) is downloaded. This contains specifications for a subset of Java's standard library, following the package structure of the JDK. Any missing specifications could be added into files in the projects contained. Note that the specifications provided for standard library classes and methods are assumed, rather than verified against particular implementations, so any added specifications should be carefully examined so as not to introduce potential unsoundness. If appropriate, additional standard library specifications could be merged into the official release of OpenJML by making a pull request to the development branch of OpenJML/Specs.

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ You can get the latest release from Maven:
5656
<dependency>
5757
<groupId>com.amazonaws</groupId>
5858
<artifactId>aws-encryption-sdk-java</artifactId>
59-
<version>2.2.0</version>
59+
<version>2.3.0</version>
6060
</dependency>
6161
```
6262

‎aws-encryption-sdk-specification

‎codebuild/compliance.yml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
runtime-versions:
6+
nodejs: 12
7+
build:
8+
commands:
9+
- ./util/test-conditions.sh

‎codebuild/corretto11.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ phases:
66
java: corretto11
77
build:
88
commands:
9-
- mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.2.0.zip"
9+
- mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.3.0-mrks.zip"

‎codebuild/corretto8.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ phases:
66
java: corretto8
77
build:
88
commands:
9-
- mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.2.0.zip"
9+
- mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.3.0-mrks.zip"

‎codebuild/openjdk11.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ phases:
66
java: openjdk11
77
build:
88
commands:
9-
- mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.2.0.zip"
9+
- mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.3.0-mrks.zip"

‎codebuild/openjdk8.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ phases:
66
java: openjdk8
77
build:
88
commands:
9-
- mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.2.0.zip"
9+
- mvn install -Dgpg.skip=true "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.3.0-mrks.zip"

‎compliance_exceptions/aws-kms-mrk-aware-multi-keyrings.java

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
// The AWS Encryption SDK - Java does not implement
5+
// any of the Keyring interface at this time.
6+
7+
//= compliance/framework/aws-kms/aws-kms-mrk-aware-multi-keyrings.txt#2.5
8+
//= type=exception
9+
//# The caller MUST provide:
10+
//#
11+
//# * A set of Region strings
12+
//#
13+
//# * An optional discovery filter that is an AWS partition and a set of
14+
//# AWS accounts
15+
//#
16+
//# * An optional method that can take a region string and return an AWS
17+
//# KMS client e.g. a regional client supplier
18+
//#
19+
//# * An optional list of AWS KMS grant tokens
20+
//#
21+
//# If an empty set of Region is provided this function MUST fail. If
22+
//# any element of the set of regions is null or an empty string this
23+
//# function MUST fail. If a regional client supplier is not passed,
24+
//# then a default MUST be created that takes a region string and
25+
//# generates a default AWS SDK client for the given region.
26+
//#
27+
//# A set of AWS KMS clients MUST be created by calling regional client
28+
//# supplier for each region in the input set of regions.
29+
//#
30+
//# Then a set of AWS KMS MRK Aware Symmetric Region Discovery Keyring
31+
//# (aws-kms-mrk-aware-symmetric-region-discovery-keyring.md) MUST be
32+
//# created for each AWS KMS client by initializing each keyring with
33+
//#
34+
//# * The AWS KMS client
35+
//#
36+
//# * The input discovery filter
37+
//#
38+
//# * The input AWS KMS grant tokens
39+
//#
40+
//# Then a Multi-Keyring (../multi-keyring.md#inputs) MUST be initialize
41+
//# by using this set of discovery keyrings as the child keyrings
42+
//# (../multi-keyring.md#child-keyrings). This Multi-Keyring MUST be
43+
//# this functions output.
44+
45+
//= compliance/framework/aws-kms/aws-kms-mrk-aware-multi-keyrings.txt#2.6
46+
//= type=exception
47+
//# The caller MUST provide:
48+
//#
49+
//# * An optional AWS KMS key identifiers to use as the generator.
50+
//#
51+
//# * An optional set of AWS KMS key identifiers to us as child
52+
//# keyrings.
53+
//#
54+
//# * An optional method that can take a region string and return an AWS
55+
//# KMS client e.g. a regional client supplier
56+
//#
57+
//# * An optional list of AWS KMS grant tokens
58+
//#
59+
//# If any of the AWS KMS key identifiers is null or an empty string this
60+
//# function MUST fail. At least one non-null or non-empty string AWS
61+
//# KMS key identifiers exists in the input this function MUST fail. All
62+
//# AWS KMS identifiers are passed to Assert AWS KMS MRK are unique (aws-
63+
//# kms-mrk-are-unique.md#Implementation) and the function MUST return
64+
//# success otherwise this MUST fail. If a regional client supplier is
65+
//# not passed, then a default MUST be created that takes a region string
66+
//# and generates a default AWS SDK client for the given region.
67+
//#
68+
//# If there is a generator input then the generator keyring MUST be a
69+
//# AWS KMS MRK Aware Symmetric Keyring (aws-kms-mrk-aware-symmetric-
70+
//# keyring.md) initialized with
71+
//#
72+
//# * The generator input.
73+
//#
74+
//# * The AWS KMS client that MUST be created by the regional client
75+
//# supplier when called with the region part of the generator ARN or
76+
//# a signal for the AWS SDK to select the default region.
77+
//#
78+
//# * The input list of AWS KMS grant tokens
79+
//#
80+
//# If there is a set of child identifiers then a set of AWS KMS MRK
81+
//# Aware Symmetric Keyring (aws-kms-mrk-aware-symmetric-keyring.md) MUST
82+
//# be created for each AWS KMS key identifier by initialized each
83+
//# keyring with
84+
//#
85+
//# * AWS KMS key identifier.
86+
//#
87+
//# * The AWS KMS client that MUST be created by the regional client
88+
//# supplier when called with the region part of the AWS KMS key
89+
//# identifier or a signal for the AWS SDK to select the default
90+
//# region.
91+
//#
92+
//# * The input list of AWS KMS grant tokens
93+
//#
94+
//# NOTE: The AWS Encryption SDK SHOULD NOT attempt to evaluate its own
95+
//# default region.
96+
//#
97+
//# Then a Multi-Keyring (../multi-keyring.md#inputs) MUST be initialize
98+
//# by using this generator keyring as the generator keyring (../multi-
99+
//# keyring.md#generator-keyring) and this set of child keyrings as the
100+
//# child keyrings (../multi-keyring.md#child-keyrings). This Multi-
101+
//# Keyring MUST be this functions output.
102+
103+
104+

0 commit comments

Comments
 (0)