Skip to content

Commit e014f45

Browse files
texastonytexastony
committed
feat!: Drop Support & Dependency on AWS SDK V2
BREAKING CHANGE: The AWS Encryption SDK for JavaScript: - does not supports the AWS SDK for JavaScript V2 - requires the AWS SDK for JavaScript V3's kms-client (if using the KMS Keyring).
1 parent f495bb6 commit e014f45

13 files changed

+8215
-9664
lines changed

‎modules/integration-browser/package.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@
1919
"dependencies": {
2020
"@aws-crypto/client-browser": "file:../client-browser",
2121
"@aws-crypto/integration-vectors": "file:../integration-vectors",
22-
"@aws-sdk/credential-provider-node": "^3.11.0",
23-
"@aws-sdk/karma-credential-loader": "3.38.0",
24-
"@aws-sdk/util-base64-browser": "^3.10.0",
25-
"@aws-sdk/util-utf8-browser": "3.23.0",
22+
"@aws-sdk/credential-provider-node": "^3.362.0",
23+
"@aws-sdk/karma-credential-loader": "^3.38.0",
24+
"@aws-sdk/util-base64-browser": "^3.209.0",
25+
"@aws-sdk/util-utf8-browser": "^3.23.0",
2626
"@trust/keyto": "^1.0.1",
2727
"@types/got": "^9.6.9",
2828
"@types/stream-to-promise": "^2.2.0",

‎modules/kms-keyring-browser/package.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
"@aws-crypto/kms-keyring": "file:../kms-keyring",
2323
"@aws-crypto/material-management-browser": "file:../material-management-browser",
2424
"@aws-crypto/web-crypto-backend": "file:../web-crypto-backend",
25-
"aws-sdk": "^2.650.0",
2625
"tslib": "^2.2.0"
2726
},
2827
"sideEffects": false,

‎modules/kms-keyring-browser/src/kms_keyring_browser.ts

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import {
2323
KeyringWebCrypto,
2424
Newable,
2525
} from '@aws-crypto/material-management-browser'
26-
import { KMS } from 'aws-sdk'
26+
import { KMS, KMSClientConfig } from '@aws-sdk/client-kms'
2727
import { version } from './version'
2828
const getKmsClient = getClient(KMS, {
2929
customUserAgent: `AwsEncryptionSdkJavascriptBrowser/${version}`,
@@ -33,10 +33,7 @@ const cacheKmsClients = cacheClients(getKmsClient)
3333
export type KmsKeyringWebCryptoInput = Partial<
3434
KmsKeyringInput<AwsEsdkKMSInterface>
3535
>
36-
export type KMSWebCryptoConstructible = KMSConstructible<
37-
KMS,
38-
KMS.ClientConfiguration
39-
>
36+
export type KMSWebCryptoConstructible = KMSConstructible<KMS, KMSClientConfig>
4037
export type KmsWebCryptoClientSupplier = KmsClientSupplier<AwsEsdkKMSInterface>
4138

4239
export class KmsKeyringBrowser extends KmsKeyringClass<

‎modules/kms-keyring-browser/test/kms_keyring_browser.test.ts

Lines changed: 1 addition & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
import * as chai from 'chai'
77
import chaiAsPromised from 'chai-as-promised'
88
import { KmsKeyringBrowser, getClient } from '../src/index'
9-
import { KMS as V2KMS } from 'aws-sdk'
109
import { KMS as V3KMS } from '@aws-sdk/client-kms'
1110
import {
1211
KeyringWebCrypto,
@@ -30,7 +29,7 @@ describe('KmsKeyringBrowser::constructor', () => {
3029
const keyArn =
3130
'arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f'
3231
const keyIds = [keyArn]
33-
const clientProvider = getClient(V2KMS, { credentials })
32+
const clientProvider = getClient(V3KMS, { credentials })
3433

3534
const test = new KmsKeyringBrowser({
3635
clientProvider,
@@ -51,46 +50,6 @@ describe('KmsKeyringBrowser::constructor', () => {
5150
})
5251
})
5352

54-
describe('KmsKeyringBrowser can encrypt/decrypt with AWS SDK v2 client', () => {
55-
const generatorKeyId =
56-
'arn:aws:kms:us-west-2:658956600833:alias/EncryptDecrypt'
57-
const keyArn =
58-
'arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f'
59-
const keyIds = [keyArn]
60-
const clientProvider = getClient(V2KMS, { credentials })
61-
const keyring = new KmsKeyringBrowser({
62-
clientProvider,
63-
generatorKeyId,
64-
keyIds,
65-
})
66-
let encryptedDataKey: EncryptedDataKey
67-
68-
it('can encrypt and create unencrypted data key', async () => {
69-
const suite = new WebCryptoAlgorithmSuite(
70-
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256
71-
)
72-
const material = new WebCryptoEncryptionMaterial(suite, {})
73-
const test = await keyring.onEncrypt(material)
74-
expect(test.hasValidKey()).to.equal(true)
75-
const udk = test.getUnencryptedDataKey()
76-
expect(udk).to.have.lengthOf(suite.keyLengthBytes)
77-
expect(test.encryptedDataKeys).to.have.lengthOf(2)
78-
const [edk] = test.encryptedDataKeys
79-
encryptedDataKey = edk
80-
})
81-
82-
it('can decrypt an EncryptedDataKey', async () => {
83-
const suite = new WebCryptoAlgorithmSuite(
84-
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256
85-
)
86-
const material = new WebCryptoDecryptionMaterial(suite, {})
87-
const test = await keyring.onDecrypt(material, [encryptedDataKey])
88-
expect(test.hasValidKey()).to.equal(true)
89-
// The UnencryptedDataKey should be zeroed, because the cryptoKey has been set
90-
expect(() => test.getUnencryptedDataKey()).to.throw()
91-
})
92-
})
93-
9453
describe('KmsKeyringBrowser can encrypt/decrypt with AWS SDK v3 client', () => {
9554
const generatorKeyId =
9655
'arn:aws:kms:us-west-2:658956600833:alias/EncryptDecrypt'

‎modules/kms-keyring-browser/test/kms_mrk_discovery_keyring_browser.test.ts

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ import {
1616
AlgorithmSuiteIdentifier,
1717
WebCryptoDecryptionMaterial,
1818
} from '@aws-crypto/material-management-browser'
19-
import { KMS as V2KMS } from 'aws-sdk'
2019
import { KMS as V3KMS } from '@aws-sdk/client-kms'
2120

2221
chai.use(chaiAsPromised)
@@ -57,54 +56,6 @@ describe('AwsKmsMrkAwareSymmetricDiscoveryKeyringBrowser::constructor', () => {
5756
/* Injected from @aws-sdk/karma-credential-loader. */
5857
declare const credentials: any
5958

60-
describe('AwsKmsMrkAwareSymmetricKeyringBrowser can encrypt/decrypt with AWS SDK v2 client', () => {
61-
const discoveryFilter = { accountIDs: ['658956600833'], partition: 'aws' }
62-
63-
const eastKeyId =
64-
'arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7'
65-
const grantTokens = ['grant']
66-
const encryptionContext = { some: 'context' }
67-
const suite = new WebCryptoAlgorithmSuite(
68-
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256
69-
)
70-
71-
const keyring = new AwsKmsMrkAwareSymmetricDiscoveryKeyringBrowser({
72-
// Note the difference in the region from the keyId
73-
client: new V2KMS({ region: 'us-west-2', credentials }),
74-
discoveryFilter,
75-
grantTokens,
76-
})
77-
78-
it('throws an error on encrypt', async () => {
79-
const material = new WebCryptoEncryptionMaterial(suite, encryptionContext)
80-
return expect(keyring.onEncrypt(material)).to.rejectedWith(
81-
Error,
82-
'AwsKmsMrkAwareSymmetricDiscoveryKeyring cannot be used to encrypt'
83-
)
84-
})
85-
86-
it('can decrypt an EncryptedDataKey', async () => {
87-
const encryptKeyring = new AwsKmsMrkAwareSymmetricKeyringBrowser({
88-
client: new V2KMS({ region: 'us-east-1', credentials }),
89-
keyId: eastKeyId,
90-
grantTokens,
91-
})
92-
const encryptMaterial = await encryptKeyring.onEncrypt(
93-
new WebCryptoEncryptionMaterial(suite, encryptionContext)
94-
)
95-
const [edk] = encryptMaterial.encryptedDataKeys
96-
97-
const material = await keyring.onDecrypt(
98-
new WebCryptoDecryptionMaterial(suite, encryptionContext),
99-
[edk]
100-
)
101-
const test = await keyring.onDecrypt(material, [edk])
102-
expect(test.hasValidKey()).to.equal(true)
103-
// The UnencryptedDataKey should be zeroed, because the cryptoKey has been set
104-
expect(() => test.getUnencryptedDataKey()).to.throw()
105-
})
106-
})
107-
10859
describe('AwsKmsMrkAwareSymmetricKeyringBrowser can encrypt/decrypt with AWS SDK v3 client', () => {
10960
const discoveryFilter = { accountIDs: ['658956600833'], partition: 'aws' }
11061

‎modules/kms-keyring-browser/test/kms_mrk_keyring_browser.test.ts

Lines changed: 0 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ import {
1515
WebCryptoDecryptionMaterial,
1616
KeyringTraceFlag,
1717
} from '@aws-crypto/material-management-browser'
18-
import { KMS as V2KMS } from 'aws-sdk'
1918
import { KMS as V3KMS } from '@aws-sdk/client-kms'
2019

2120
chai.use(chaiAsPromised)
@@ -51,69 +50,6 @@ describe('AwsKmsMrkAwareSymmetricKeyringBrowser::constructor', () => {
5150
/* Injected from @aws-sdk/karma-credential-loader. */
5251
declare const credentials: any
5352

54-
describe('AwsKmsMrkAwareSymmetricKeyringBrowser can encrypt/decrypt with AWS SDK v2 client', () => {
55-
const westKeyId =
56-
'arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7'
57-
const eastKeyId =
58-
'arn:aws:kms:us-east-1:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7'
59-
const grantTokens = ['grant']
60-
const encryptionContext = { some: 'context' }
61-
const suite = new WebCryptoAlgorithmSuite(
62-
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256
63-
)
64-
65-
const encryptKeyring = new AwsKmsMrkAwareSymmetricKeyringBrowser({
66-
client: new V2KMS({ region: 'us-west-2', credentials }),
67-
keyId: westKeyId,
68-
grantTokens,
69-
})
70-
const decryptKeyring = new AwsKmsMrkAwareSymmetricKeyringBrowser({
71-
client: new V2KMS({ region: 'us-east-1', credentials }),
72-
keyId: eastKeyId,
73-
grantTokens,
74-
})
75-
let encryptedDataKey: EncryptedDataKey
76-
77-
it('can encrypt and create unencrypted data key', async () => {
78-
const material = new WebCryptoEncryptionMaterial(suite, encryptionContext)
79-
const test = await encryptKeyring.onEncrypt(material)
80-
expect(test.hasValidKey()).to.equal(true)
81-
const udk = test.getUnencryptedDataKey()
82-
expect(udk).to.have.lengthOf(suite.keyLengthBytes)
83-
expect(test.encryptedDataKeys).to.have.lengthOf(1)
84-
const [edk] = test.encryptedDataKeys
85-
encryptedDataKey = edk
86-
})
87-
88-
it('can encrypt a pre-existing plaintext data key', async () => {
89-
const seedMaterial = new WebCryptoEncryptionMaterial(
90-
suite,
91-
encryptionContext
92-
).setUnencryptedDataKey(new Uint8Array(suite.keyLengthBytes), {
93-
keyName: 'keyName',
94-
keyNamespace: 'keyNamespace',
95-
flags: KeyringTraceFlag.WRAPPING_KEY_GENERATED_DATA_KEY,
96-
})
97-
const encryptTest = await encryptKeyring.onEncrypt(seedMaterial)
98-
expect(encryptTest.hasValidKey()).to.equal(true)
99-
expect(encryptTest.encryptedDataKeys).to.have.lengthOf(1)
100-
const [kmsEDK] = encryptTest.encryptedDataKeys
101-
expect(kmsEDK.providerId).to.equal('aws-kms')
102-
expect(kmsEDK.providerInfo).to.equal(westKeyId)
103-
})
104-
105-
it('can decrypt an EncryptedDataKey', async () => {
106-
const suite = new WebCryptoAlgorithmSuite(
107-
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256
108-
)
109-
const material = new WebCryptoDecryptionMaterial(suite, encryptionContext)
110-
const test = await decryptKeyring.onDecrypt(material, [encryptedDataKey])
111-
expect(test.hasValidKey()).to.equal(true)
112-
// The UnencryptedDataKey should be zeroed, because the cryptoKey has been set
113-
expect(() => test.getUnencryptedDataKey()).to.throw()
114-
})
115-
})
116-
11753
describe('AwsKmsMrkAwareSymmetricKeyringBrowser can encrypt/decrypt with AWS SDK v3 client', () => {
11854
const westKeyId =
11955
'arn:aws:kms:us-west-2:658956600833:key/mrk-80bd8ecdcd4342aebd84b7dc9da498a7'

‎modules/kms-keyring-node/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
"dependencies": {
2222
"@aws-crypto/kms-keyring": "file:../kms-keyring",
2323
"@aws-crypto/material-management-node": "file:../material-management-node",
24-
"aws-sdk": "^2.650.0",
24+
"@aws-sdk/client-kms": "^3.362.0",
2525
"tslib": "^2.2.0"
2626
},
2727
"sideEffects": false,

‎modules/kms-keyring-node/src/kms_keyring_node.ts

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,15 @@ import {
1818
Newable,
1919
NodeAlgorithmSuite,
2020
} from '@aws-crypto/material-management-node'
21-
import { KMS } from 'aws-sdk'
21+
import { KMS, KMSClientConfig } from '@aws-sdk/client-kms'
2222
import { version } from './version'
2323
const getKmsClient = getClient(KMS, {
2424
customUserAgent: `AwsEncryptionSdkJavascriptNodejs/${version}`,
2525
})
2626
const cacheKmsClients = cacheClients(getKmsClient)
2727

2828
export type KmsKeyringNodeInput = Partial<KmsKeyringInput<AwsEsdkKMSInterface>>
29-
export type KMSNodeConstructible = KMSConstructible<
30-
KMS,
31-
KMS.ClientConfiguration
32-
>
29+
export type KMSNodeConstructible = KMSConstructible<KMS, KMSClientConfig>
3330
export type KmsNodeClientSupplier = KmsClientSupplier<AwsEsdkKMSInterface>
3431

3532
export class KmsKeyringNode extends KmsKeyringClass<

‎modules/kms-keyring-node/test/kms_keyring_node.test.ts

Lines changed: 0 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55

66
import { expect } from 'chai'
77
import { KmsKeyringNode, getClient } from '../src/index'
8-
import { KMS as V2KMS } from 'aws-sdk'
98
import { KMS as V3KMS } from '@aws-sdk/client-kms'
109
import {
1110
KeyringNode,
@@ -40,44 +39,6 @@ describe('KmsKeyringNode::constructor', () => {
4039
})
4140
})
4241

43-
describe('KmsKeyringNode can encrypt/decrypt with AWS SDK v2 client', () => {
44-
const generatorKeyId =
45-
'arn:aws:kms:us-west-2:658956600833:alias/EncryptDecrypt'
46-
const keyArn =
47-
'arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f'
48-
const keyIds = [keyArn]
49-
50-
const clientProvider = getClient(V2KMS)
51-
52-
const keyring = new KmsKeyringNode({ clientProvider, generatorKeyId, keyIds })
53-
let encryptedDataKey: EncryptedDataKey
54-
let udk: Uint8Array
55-
56-
it('can encrypt and create unencrypted data key', async () => {
57-
const suite = new NodeAlgorithmSuite(
58-
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256
59-
)
60-
const material = new NodeEncryptionMaterial(suite, {})
61-
const test = await keyring.onEncrypt(material)
62-
expect(test.hasValidKey()).to.equal(true)
63-
udk = unwrapDataKey(test.getUnencryptedDataKey())
64-
expect(udk).to.have.lengthOf(suite.keyLengthBytes)
65-
expect(test.encryptedDataKeys).to.have.lengthOf(2)
66-
const [edk] = test.encryptedDataKeys
67-
encryptedDataKey = edk
68-
})
69-
70-
it('can decrypt an EncryptedDataKey', async () => {
71-
const suite = new NodeAlgorithmSuite(
72-
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256
73-
)
74-
const material = new NodeDecryptionMaterial(suite, {})
75-
const test = await keyring.onDecrypt(material, [encryptedDataKey])
76-
expect(test.hasValidKey()).to.equal(true)
77-
expect(unwrapDataKey(test.getUnencryptedDataKey())).to.deep.equal(udk)
78-
})
79-
})
80-
8142
describe('KmsKeyringNode can encrypt/decrypt with AWS SDK v3 client', () => {
8243
const generatorKeyId =
8344
'arn:aws:kms:us-west-2:658956600833:alias/EncryptDecrypt'

‎modules/kms-keyring-node/test/kms_mrk_discovery_keyring_node.test.ts

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ import {
1717
} from '@aws-crypto/material-management-node'
1818
chai.use(chaiAsPromised)
1919
const { expect } = chai
20-
import { KMS as V2KMS } from 'aws-sdk'
2120
import { KMS as V3KMS } from '@aws-sdk/client-kms'
2221

2322
describe('AwsKmsMrkAwareSymmetricKeyringNode::constructor', () => {
@@ -52,54 +51,6 @@ describe('AwsKmsMrkAwareSymmetricKeyringNode::constructor', () => {
5251
})
5352
})
5453

55-
describe('AwsKmsMrkAwareSymmetricDiscoveryKeyringNode can encrypt/decrypt with AWS SDK v2 client', () => {
56-
const discoveryFilter = { accountIDs: ['658956600833'], partition: 'aws' }
57-
const keyId =
58-
'arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f'
59-
const grantTokens = ['grant']
60-
const encryptionContext = { some: 'context' }
61-
const suite = new NodeAlgorithmSuite(
62-
AlgorithmSuiteIdentifier.ALG_AES256_GCM_IV12_TAG16_HKDF_SHA256
63-
)
64-
const client = new V2KMS({ region: 'us-west-2' })
65-
66-
const keyring = new AwsKmsMrkAwareSymmetricDiscoveryKeyringNode({
67-
client,
68-
discoveryFilter,
69-
grantTokens,
70-
})
71-
it('throws an error on encrypt', async () => {
72-
const material = new NodeEncryptionMaterial(suite, encryptionContext)
73-
await expect(keyring.onEncrypt(material)).to.rejectedWith(
74-
Error,
75-
'AwsKmsMrkAwareSymmetricDiscoveryKeyring cannot be used to encrypt'
76-
)
77-
})
78-
79-
it('can decrypt an EncryptedDataKey', async () => {
80-
const { CiphertextBlob } = await client
81-
.generateDataKey({
82-
KeyId: keyId,
83-
NumberOfBytes: suite.keyLengthBytes,
84-
EncryptionContext: encryptionContext,
85-
})
86-
.promise()
87-
needs(Buffer.isBuffer(CiphertextBlob), 'never')
88-
const edk = new EncryptedDataKey({
89-
providerId: 'aws-kms',
90-
providerInfo: keyId,
91-
encryptedDataKey: new Uint8Array(CiphertextBlob),
92-
})
93-
94-
const material = await keyring.onDecrypt(
95-
new NodeDecryptionMaterial(suite, encryptionContext),
96-
[edk]
97-
)
98-
const decryptTest = await keyring.onDecrypt(material, [edk])
99-
expect(decryptTest.hasValidKey()).to.equal(true)
100-
})
101-
})
102-
10354
describe('AwsKmsMrkAwareSymmetricDiscoveryKeyringNode can encrypt/decrypt with AWS SDK v3 client', () => {
10455
const discoveryFilter = { accountIDs: ['658956600833'], partition: 'aws' }
10556
const keyId =

0 commit comments

Comments
 (0)