Skip to content

Commit d00281b

Browse files
Rewording based on feedback
1 parent c5ba94e commit d00281b

File tree

2 files changed

+10
-12
lines changed

2 files changed

+10
-12
lines changed

src/examples/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ We start with AWS KMS examples, then show how to use other wrapping keys.
3939
* [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/DiscoveryDecryptInRegionOnly.java)
4040
* How to decrypt with a preferred region but failover to others
4141
* [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/DiscoveryDecryptWithPreferredRegions.java)
42-
* How to replicate the behavior of an AWS KMS master key provider
42+
* How to reproduce the behavior of an AWS KMS master key provider
4343
* [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/ActLikeAwsKmsMasterKeyProvider.java)
4444
* Using raw wrapping keys
4545
* How to use a raw AES wrapping key

src/examples/java/com/amazonaws/crypto/examples/keyring/awskms/ActLikeAwsKmsMasterKeyProvider.java

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,19 @@
1717
import java.util.Map;
1818

1919
/**
20-
* Before there were keyrings, there were master key providers.
21-
* Master key providers were the original configuration structure
22-
* that we provided for defining how you want to protect your data keys.
20+
* In earlier versions of the AWS Encryption SDK, you used master key providers to determine how your data keys are protected.
2321
* <p>
24-
* The AWS KMS master key provider was the tool that we provided for interacting with AWS KMS.
22+
* The AWS Encryption SDK provided an AWS KMS master key provider for interacting with AWS Key Management Service (AWS KMS).
2523
* Like the AWS KMS keyring,
2624
* the AWS KMS master key provider encrypts with all CMKs that you identify,
2725
* but unlike the AWS KMS keyring,
2826
* the AWS KMS master key provider always attempts to decrypt
2927
* *any* data keys that were encrypted under an AWS KMS CMK.
3028
* We have found that separating these two behaviors
31-
* makes it more clear what behavior to expect,
29+
* makes the expected behavior clearer,
3230
* so that is what we did with the AWS KMS keyring and the AWS KMS discovery keyring.
33-
* However, as you migrate away from master key providers to keyrings,
34-
* you might need to replicate the behavior of the AWS KMS master key provider.
31+
* However, as you migrate from master key providers to keyrings,
32+
* you might want a keyring that behaves like the AWS KMS master key provider.
3533
* <p>
3634
* This example shows how to configure a keyring that behaves like an AWS KMS master key provider.
3735
* <p>
@@ -59,15 +57,15 @@ public static void run(final AwsKmsCmkId awsKmsCmk, final byte[] sourcePlaintext
5957
encryptionContext.put("that can help you", "be confident that");
6058
encryptionContext.put("the data you are handling", "is what you think it is");
6159

62-
// This is the master key provider whose behavior we want to replicate.
60+
// This is the master key provider whose behavior we want to reproduce.
6361
//
64-
// On encrypt, this master key provider only uses the single target AWS KMS CMK.
65-
// However, on decrypt, this master key provider attempts to decrypt
62+
// When encrypting, this master key provider uses only the specified `aws_kms_cmk`.
63+
// However, when decrypting, this master key provider attempts to decrypt
6664
// any data keys that were encrypted under an AWS KMS CMK.
6765
final KmsMasterKeyProvider masterKeyProviderToReplicate = KmsMasterKeyProvider.builder()
6866
.withKeysForEncryption(awsKmsCmk.toString()).build();
6967

70-
// Create a keyring that encrypts and decrypts using a single AWS KMS CMK.
68+
// Create a single-CMK keyring that encrypts and decrypts using a single AWS KMS CMK.
7169
final Keyring singleCmkKeyring = StandardKeyrings.awsKms(awsKmsCmk);
7270

7371
// Create an AWS KMS discovery keyring that will attempt to decrypt

0 commit comments

Comments
 (0)