Skip to content

Commit 0181431

Browse files
mattsb42-awsjuneb
andauthored
docs: apply suggestions from code review
Co-Authored-By: June Blender <juneb@users.noreply.github.com>
1 parent dc8dd2f commit 0181431

File tree

1 file changed

+7
-9
lines changed

1 file changed

+7
-9
lines changed

examples/src/keyring/aws_kms/act_like_aws_kms_master_key_provider.py

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,19 @@
11
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
22
# SPDX-License-Identifier: Apache-2.0
33
"""
4-
Before there were keyrings, there were master key providers.
5-
Master key providers were the original configuration structure
6-
that we provided for defining how you want to protect your data keys.
4+
In earlier versions of the AWS Encryption SDK, you used master key providers to determine how your data keys are protected.
75
8-
The AWS KMS master key provider was the tool that we provided for interacting with AWS KMS.
6+
The AWS Encryption SDK provided an AWS KMS master key provider for interacting with AWS Key Management Service (AWS KMS).
97
Like the AWS KMS keyring,
108
the AWS KMS master key provider encrypts with all CMKs that you identify,
119
but unlike the AWS KMS keyring,
1210
the AWS KMS master key provider always attempts to decrypt
1311
*any* data keys that were encrypted under an AWS KMS CMK.
1412
We have found that separating these two behaviors
15-
makes it more clear what behavior to expect,
13+
makes the expected behavior clearer,
1614
so that is what we did with the AWS KMS keyring and the AWS KMS discovery keyring.
17-
However, as you migrate away from master key providers to keyrings,
18-
you might need to replicate the behavior of the AWS KMS master key provider.
15+
However, as you migrate from master key providers to keyrings,
16+
you might want a keyring that behaves like the AWS KMS master key provider.
1917
2018
This example shows how to configure a keyring that behaves like an AWS KMS master key provider.
2119
@@ -47,8 +45,8 @@ def run(aws_kms_cmk, source_plaintext):
4745

4846
# This is the master key provider whose behavior we want to replicate.
4947
#
50-
# On encrypt, this master key provider only uses the single target AWS KMS CMK.
51-
# However, on decrypt, this master key provider attempts to decrypt
48+
# When encrypting, this master key provider uses only the specified `aws_kms_cmk`.
49+
# However, when decrypting, this master key provider attempts to decrypt
5250
# any data keys that were encrypted under an AWS KMS CMK.
5351
_master_key_provider_to_replicate = KMSMasterKeyProvider(key_ids=[aws_kms_cmk]) # noqa: intentionally never used
5452

0 commit comments

Comments
 (0)