|
| 1 | +# Due to how Python MasterKeys and MasterKeyProviders are set up, |
| 2 | +# there are some parts of the Java-focused spec which are non-applicable |
| 3 | + |
| 4 | +# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6 |
| 5 | +# //= type=exception |
| 6 | +# //# The regional client |
| 7 | +# //# supplier MUST be defined in discovery mode. |
| 8 | +# // The Python implementation does not include a client supplier as a configuration option. |
| 9 | +# // Instead a list of regions may be passed. If not passed, a default region will be used. |
| 10 | +# // This behavior is true even of Discovery MKPs. |
| 11 | + |
| 12 | +# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.7 |
| 13 | +# //= type=exception |
| 14 | +# //# The function MUST only provide master keys if the input provider id |
| 15 | +# //# equals "aws-kms". |
| 16 | +# // Python does not take in provider ID as input to this new_master_key. |
| 17 | +# // Each MK determines on it's own whether to process based on provider ID in owns_data_key |
| 18 | + |
| 19 | +# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.7 |
| 20 | +# //= type=exception |
| 21 | +# //# An AWS KMS client |
| 22 | +# //# MUST be obtained by calling the regional client supplier with this |
| 23 | +# //# AWS Region. |
| 24 | +# // Python doesn't use a client-supplier, but _client(new_key_id) will grab a client |
| 25 | +# // based on the region in new_key_id, which is always the behavior we want. |
| 26 | + |
| 27 | +# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.9 |
| 28 | +# //= type=exception |
| 29 | +# //# The set of encrypted data keys MUST first be filtered to match this |
| 30 | +# //# master key's configuration. |
| 31 | +# // Each MK is responsible for defining whether an EDK matches it's configuration in |
| 32 | +# // as part of _decrypt_data_key. |
| 33 | + |
| 34 | +# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.7 |
| 35 | +# //= type=exception |
| 36 | +# //# In strict mode, the requested AWS KMS key ARN MUST match a member of the configured key ids by using AWS |
| 37 | +# //# KMS MRK Match for Decrypt (aws-kms-mrk-match-for-decrypt.md#implementation) otherwise this function MUST error. |
| 38 | +# // Python isn't concerned with ensuring the configured key ids match during new_master_key, given that |
| 39 | +# // Python doesn't filter EDKs before creating the master keys for decryption. Each MK is responsible for raising |
| 40 | +# // an error if the EDK isn't an MRK aware match. For encryption, the keys are pre-populated based on the configured |
| 41 | +# // keys, which again makes any check non-applicable. |
| 42 | + |
| 43 | +# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6 |
| 44 | +# //= type=exception |
| 45 | +# //# On initialization the caller MUST provide: |
| 46 | +# // Strict and discovery modes and their corresponding inputs are split |
| 47 | +# // into two different classes. Additionally, |
| 48 | +# // Python does not take in a regional client supplier, |
| 49 | +# // but instead takes in a list of regions to create clients out of. |
| 50 | + |
| 51 | +# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.7 |
| 52 | +# //= type=exception |
| 53 | +# //# Finally if the |
| 54 | +# //# provider info is identified as a multi-Region key (aws-kms-key- |
| 55 | +# //# arn.md#identifying-an-aws-kms-multi-region-key) the AWS Region MUST |
| 56 | +# //# be the region from the AWS KMS key in the configured key ids matched |
| 57 | +# //# to the requested AWS KMS key by using AWS KMS MRK Match for Decrypt |
| 58 | +# //# (aws-kms-mrk-match-for-decrypt.md#implementation). |
| 59 | +# // This is not relevant due to the fact that Strict MRK Aware MKPs will create an MK for |
| 60 | +# // each configured key ID on initialization, each with |
| 61 | +# // a client that matches the region in the configured key ID. |
| 62 | +# // During decryption, the region from the EDK's provider info does |
| 63 | +# // not figure into what client region to use. |
| 64 | +# // The MKs the MKP vends should always have a client region that matches the key ID |
| 65 | + |
| 66 | +# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.9 |
| 67 | +# //= type=exception |
| 68 | +# //# If this attempt results in an error, then |
| 69 | +# //# these errors MUST be collected. |
| 70 | +# // Python logs errors instead of collecting them. |
| 71 | + |
| 72 | +# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.9 |
| 73 | +# //= type=exception |
| 74 | +# //# Additionally |
| 75 | +# //# each provider info MUST be a valid AWS KMS ARN (aws-kms-key-arn.md#a- |
| 76 | +# //# valid-aws-kms-arn) with a resource type of "key". |
| 77 | +# // Python MKPs do not filter before using each MK to decrypt. Each MK is |
| 78 | +# // Individually responsible for throwing if it shouldn't be used for decrypt. |
| 79 | + |
0 commit comments