|
1 | 1 | # Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
|
2 | 2 | # SPDX-License-Identifier: Apache-2.0
|
3 | 3 | """
|
4 |
| -Before there were keyrings, there were master key providers. |
5 |
| -Master key providers were the original configuration structure |
6 |
| -that we provided for defining how you want to protect your data keys. |
| 4 | +In earlier versions of the AWS Encryption SDK, you used master key providers to determine how your data keys are protected. |
7 | 5 |
|
8 |
| -The AWS KMS master key provider was the tool that we provided for interacting with AWS KMS. |
| 6 | +The AWS Encryption SDK provided an AWS KMS master key provider for interacting with AWS Key Management Service (AWS KMS). |
9 | 7 | Like the AWS KMS keyring,
|
10 | 8 | the AWS KMS master key provider encrypts with all CMKs that you identify,
|
11 | 9 | but unlike the AWS KMS keyring,
|
12 | 10 | the AWS KMS master key provider always attempts to decrypt
|
13 | 11 | *any* data keys that were encrypted under an AWS KMS CMK.
|
14 | 12 | We have found that separating these two behaviors
|
15 |
| -makes it more clear what behavior to expect, |
| 13 | +makes the expected behavior clearer, |
16 | 14 | so that is what we did with the AWS KMS keyring and the AWS KMS discovery keyring.
|
17 |
| -However, as you migrate away from master key providers to keyrings, |
18 |
| -you might need to replicate the behavior of the AWS KMS master key provider. |
| 15 | +However, as you migrate from master key providers to keyrings, |
| 16 | +you might want a keyring that behaves like the AWS KMS master key provider. |
19 | 17 |
|
20 | 18 | This example shows how to configure a keyring that behaves like an AWS KMS master key provider.
|
21 | 19 |
|
@@ -47,8 +45,8 @@ def run(aws_kms_cmk, source_plaintext):
|
47 | 45 |
|
48 | 46 | # This is the master key provider whose behavior we want to replicate.
|
49 | 47 | #
|
50 |
| - # On encrypt, this master key provider only uses the single target AWS KMS CMK. |
51 |
| - # However, on decrypt, this master key provider attempts to decrypt |
| 48 | + # When encrypting, this master key provider uses only the specified `aws_kms_cmk`. |
| 49 | + # However, when decrypting, this master key provider attempts to decrypt |
52 | 50 | # any data keys that were encrypted under an AWS KMS CMK.
|
53 | 51 | _master_key_provider_to_replicate = KMSMasterKeyProvider(key_ids=[aws_kms_cmk]) # noqa: intentionally never used
|
54 | 52 |
|
|
0 commit comments