|
17 | 17 | import java.util.Map;
|
18 | 18 |
|
19 | 19 | /**
|
20 |
| - * Before there were keyrings, there were master key providers. |
21 |
| - * Master key providers were the original configuration structure |
22 |
| - * that we provided for defining how you want to protect your data keys. |
| 20 | + * In earlier versions of the AWS Encryption SDK, you used master key providers to determine how your data keys are protected. |
23 | 21 | * <p>
|
24 |
| - * The AWS KMS master key provider was the tool that we provided for interacting with AWS KMS. |
| 22 | + * The AWS Encryption SDK provided an AWS KMS master key provider for interacting with AWS Key Management Service (AWS KMS). |
25 | 23 | * Like the AWS KMS keyring,
|
26 | 24 | * the AWS KMS master key provider encrypts with all CMKs that you identify,
|
27 | 25 | * but unlike the AWS KMS keyring,
|
28 | 26 | * the AWS KMS master key provider always attempts to decrypt
|
29 | 27 | * *any* data keys that were encrypted under an AWS KMS CMK.
|
30 | 28 | * We have found that separating these two behaviors
|
31 |
| - * makes it more clear what behavior to expect, |
| 29 | + * makes the expected behavior clearer, |
32 | 30 | * so that is what we did with the AWS KMS keyring and the AWS KMS discovery keyring.
|
33 |
| - * However, as you migrate away from master key providers to keyrings, |
34 |
| - * you might need to replicate the behavior of the AWS KMS master key provider. |
| 31 | + * However, as you migrate from master key providers to keyrings, |
| 32 | + * you might want a keyring that behaves like the AWS KMS master key provider. |
35 | 33 | * <p>
|
36 | 34 | * This example shows how to configure a keyring that behaves like an AWS KMS master key provider.
|
37 | 35 | * <p>
|
@@ -59,15 +57,15 @@ public static void run(final AwsKmsCmkId awsKmsCmk, final byte[] sourcePlaintext
|
59 | 57 | encryptionContext.put("that can help you", "be confident that");
|
60 | 58 | encryptionContext.put("the data you are handling", "is what you think it is");
|
61 | 59 |
|
62 |
| - // This is the master key provider whose behavior we want to replicate. |
| 60 | + // This is the master key provider whose behavior we want to reproduce. |
63 | 61 | //
|
64 |
| - // On encrypt, this master key provider only uses the single target AWS KMS CMK. |
65 |
| - // However, on decrypt, this master key provider attempts to decrypt |
| 62 | + // When encrypting, this master key provider uses only the specified `aws_kms_cmk`. |
| 63 | + // However, when decrypting, this master key provider attempts to decrypt |
66 | 64 | // any data keys that were encrypted under an AWS KMS CMK.
|
67 | 65 | final KmsMasterKeyProvider masterKeyProviderToReplicate = KmsMasterKeyProvider.builder()
|
68 | 66 | .withKeysForEncryption(awsKmsCmk.toString()).build();
|
69 | 67 |
|
70 |
| - // Create a keyring that encrypts and decrypts using a single AWS KMS CMK. |
| 68 | + // Create a single-CMK keyring that encrypts and decrypts using a single AWS KMS CMK. |
71 | 69 | final Keyring singleCmkKeyring = StandardKeyrings.awsKms(awsKmsCmk);
|
72 | 70 |
|
73 | 71 | // Create an AWS KMS discovery keyring that will attempt to decrypt
|
|
0 commit comments