Skip to content

Commit 0b4d46c

Browse files
seebeesseebees
committed
Add discovery
1 parent 321e636 commit 0b4d46c

File tree

13 files changed

+174
-68
lines changed

13 files changed

+174
-68
lines changed

‎modules/branch-keystore-node/src/branch_keystore_helpers.ts

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ import {
3131
BEACON_KEY_TYPE_VALUE,
3232
POTENTIAL_BRANCH_KEY_RECORD_FIELDS,
3333
} from './constants'
34-
import { parseAwsKmsKeyArn } from '@aws-crypto/kms-keyring'
3534

3635
/**
3736
* This utility function uses a partition and sort key to query for a single branch

‎modules/branch-keystore-node/src/kms_config.ts

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ export interface KMSMultiRegionKey {
2323

2424
//= aws-encryption-sdk-specification/framework/branch-key-store.md#aws-kms-configuration
2525
//# `Discovery` does not take an additional argument.
26-
2726
export type Discovery = 'discovery'
2827

2928
//= aws-encryption-sdk-specification/framework/branch-key-store.md#aws-kms-configuration
@@ -147,11 +146,6 @@ export class KmsKeyConfig implements RegionalKmsConfig {
147146
}
148147
}
149148

150-
//= aws-encryption-sdk-specification/framework/branch-key-store.md#aws-key-arn-compatibility
151-
//# For two ARNs to be compatible:
152-
153-
//# If the [AWS KMS Configuration](#aws-kms-configuration) designates single region ARN compatibility,
154-
//# then two ARNs are compatible if they are exactly equal.
155149
isCompatibleWithArn(otherArn: string): boolean {
156150
if (this._config === 'discovery' || 'region' in this._config) {
157151
// This may result in the function being called twice.
@@ -167,10 +161,21 @@ export class KmsKeyConfig implements RegionalKmsConfig {
167161
`${otherArn} must be a well-formed AWS KMS non-alias resource arn`
168162
)
169163

164+
//= aws-encryption-sdk-specification/framework/branch-key-store.md#aws-key-arn-compatibility
165+
//# If the [AWS KMS Configuration](#aws-kms-configuration) is Discovery or MRDiscovery,
166+
//# no comparison is ever made between ARNs.
170167
return true
171168
} else if ('identifier' in this._config) {
169+
//= aws-encryption-sdk-specification/framework/branch-key-store.md#aws-key-arn-compatibility
170+
//# For two ARNs to be compatible:
171+
//# If the [AWS KMS Configuration](#aws-kms-configuration) designates single region ARN compatibility,
172+
//# then two ARNs are compatible if they are exactly equal.
172173
return this._arn == otherArn
173174
} else if ('mrkIdentifier' in this._config) {
175+
//= aws-encryption-sdk-specification/framework/branch-key-store.md#aws-key-arn-compatibility
176+
//# If the [AWS KMS Configuration](#aws-kms-configuration) designates MRK ARN compatibility,
177+
//# then two ARNs are compatible if they are equal in all parts other than the region.
178+
//# That is, they are compatible if [AWS KMS MRK Match for Decrypt](aws-kms/aws-kms-mrk-match-for-decrypt.md#implementation) returns true.
174179
return mrkAwareAwsKmsKeyIdCompare(this._arn, otherArn)
175180
} else {
176181
needs(false, 'Unexpected configuration state')

‎modules/branch-keystore-node/test/branch_keystore.test.ts

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ import {
1515
IncorrectKeyException,
1616
} from '@aws-sdk/client-kms'
1717
import { DynamoDBClient } from '@aws-sdk/client-dynamodb'
18-
import { SrkCompatibilityKmsConfig } from '../src/kms_config'
1918
import { getRegionFromIdentifier } from '@aws-crypto/kms-keyring'
2019
import {
2120
BRANCH_KEY_ACTIVE_VERSION,
@@ -47,7 +46,7 @@ describe('Test Branch keystore', () => {
4746
})
4847

4948
describe('Test constructor', () => {
50-
const KMS_CONFIGURATION = new SrkCompatibilityKmsConfig(KEY_ARN)
49+
const KMS_CONFIGURATION = { identifier: KEY_ARN }
5150

5251
const BRANCH_KEYSTORE = new BranchKeyStoreNode({
5352
storage: { ddbTableName: DDB_TABLE_NAME },
@@ -194,7 +193,7 @@ describe('Test Branch keystore', () => {
194193
const kmsClient = new KMSClient({})
195194
const ddbClient = new DynamoDBClient({})
196195
expect(() => {
197-
const kmsConfig = new SrkCompatibilityKmsConfig(KEY_ID)
196+
const kmsConfig = { identifier: KEY_ID }
198197
return new BranchKeyStoreNode({
199198
storage: { ddbTableName: DDB_TABLE_NAME, ddbClient },
200199
logicalKeyStoreName: LOGICAL_KEYSTORE_NAME,
@@ -210,7 +209,7 @@ describe('Test Branch keystore', () => {
210209
const kmsClient = new KMSClient({})
211210
const ddbClient = new DynamoDBClient({})
212211
expect(() => {
213-
const kmsConfig = new SrkCompatibilityKmsConfig(KMS_KEY_ALIAS)
212+
const kmsConfig = { identifier: KMS_KEY_ALIAS }
214213
return new BranchKeyStoreNode({
215214
storage: { ddbTableName: DDB_TABLE_NAME, ddbClient },
216215
logicalKeyStoreName: LOGICAL_KEYSTORE_NAME,
@@ -225,7 +224,7 @@ describe('Test Branch keystore', () => {
225224
it('Valid config', () => {
226225
const kmsClient = new KMSClient({})
227226
const ddbClient = new DynamoDBClient({})
228-
const kmsConfig = new SrkCompatibilityKmsConfig(KEY_ARN)
227+
const kmsConfig = { identifier: KEY_ID }
229228
const keyStore = new BranchKeyStoreNode({
230229
storage: { ddbTableName: DDB_TABLE_NAME, ddbClient },
231230
logicalKeyStoreName: LOGICAL_KEYSTORE_NAME,
@@ -243,7 +242,7 @@ describe('Test Branch keystore', () => {
243242
it('Test valid config with no clients', () => {
244243
const kmsClient = new KMSClient({})
245244
const ddbClient = new DynamoDBClient({})
246-
const kmsConfig = new SrkCompatibilityKmsConfig(KEY_ARN)
245+
const kmsConfig = { identifier: KEY_ID }
247246

248247
// test with no kms client supplied
249248
expect(
@@ -408,7 +407,7 @@ describe('Test Branch keystore', () => {
408407
it('Test get active key', async () => {
409408
const kmsClient = new KMSClient({})
410409
const ddbClient = new DynamoDBClient({})
411-
const kmsConfig = new SrkCompatibilityKmsConfig(KEY_ARN)
410+
const kmsConfig = { identifier: KEY_ID }
412411
const keyStore = new BranchKeyStoreNode({
413412
kmsConfiguration: kmsConfig,
414413
storage: { ddbTableName: DDB_TABLE_NAME, ddbClient: ddbClient },
@@ -444,7 +443,7 @@ describe('Test Branch keystore', () => {
444443
it('Test get branch key version', async () => {
445444
const kmsClient = new KMSClient({})
446445
const ddbClient = new DynamoDBClient({})
447-
const kmsConfig = new SrkCompatibilityKmsConfig(KEY_ARN)
446+
const kmsConfig = { identifier: KEY_ID }
448447

449448
const keyStore = new BranchKeyStoreNode({
450449
kmsConfiguration: kmsConfig,
@@ -494,7 +493,7 @@ describe('Test Branch keystore', () => {
494493
it('Test get active key with incorrect kms key arn', async () => {
495494
const kmsClient = new KMSClient({})
496495
const ddbClient = new DynamoDBClient({})
497-
const kmsConfig = new SrkCompatibilityKmsConfig(KEY_ARN)
496+
const kmsConfig = { identifier: KEY_ID }
498497

499498
const keyStore = new BranchKeyStoreNode({
500499
kmsConfiguration: kmsConfig,
@@ -514,7 +513,7 @@ describe('Test Branch keystore', () => {
514513
it('Test get active key with wrong logical keystore name', async () => {
515514
const kmsClient = new KMSClient({})
516515
const ddbClient = new DynamoDBClient({})
517-
const kmsConfig = new SrkCompatibilityKmsConfig(KEY_ARN)
516+
const kmsConfig = { identifier: KEY_ID }
518517

519518
const keyStore = new BranchKeyStoreNode({
520519
kmsConfiguration: kmsConfig,
@@ -532,7 +531,7 @@ describe('Test Branch keystore', () => {
532531
it('Test get active key does not exist fails', async () => {
533532
const kmsClient = new KMSClient({})
534533
const ddbClient = new DynamoDBClient({})
535-
const kmsConfig = new SrkCompatibilityKmsConfig(KEY_ARN)
534+
const kmsConfig = { identifier: KEY_ID }
536535

537536
const keyStore = new BranchKeyStoreNode({
538537
kmsConfiguration: kmsConfig,
@@ -550,7 +549,7 @@ describe('Test Branch keystore', () => {
550549
})
551550

552551
it('Test get active key with no clients', async () => {
553-
const kmsConfig = new SrkCompatibilityKmsConfig(KEY_ARN)
552+
const kmsConfig = { identifier: KEY_ID }
554553
const keyStore = new BranchKeyStoreNode({
555554
kmsConfiguration: kmsConfig,
556555
logicalKeyStoreName: LOGICAL_KEYSTORE_NAME,
@@ -564,7 +563,7 @@ describe('Test Branch keystore', () => {
564563
it('Test get active key for lying branch key', async () => {
565564
const kmsClient = new KMSClient({})
566565
const ddbClient = new DynamoDBClient({})
567-
const kmsConfig = new SrkCompatibilityKmsConfig(POSTAL_HORN_KEY_ARN)
566+
const kmsConfig = { identifier: POSTAL_HORN_KEY_ARN }
568567

569568
const keyStore = new BranchKeyStoreNode({
570569
kmsConfiguration: kmsConfig,
@@ -582,7 +581,7 @@ describe('Test Branch keystore', () => {
582581
it('Test get versioned key for lying branch key', async () => {
583582
const kmsClient = new KMSClient({})
584583
const ddbClient = new DynamoDBClient({})
585-
const kmsConfig = new SrkCompatibilityKmsConfig(POSTAL_HORN_KEY_ARN)
584+
const kmsConfig = { identifier: POSTAL_HORN_KEY_ARN }
586585

587586
const keyStore = new BranchKeyStoreNode({
588587
kmsConfiguration: kmsConfig,

‎modules/branch-keystore-node/test/branch_keystore_helpers.test.ts

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
import chai, { expect } from 'chai'
55
import chaiAsPromised from 'chai-as-promised'
66
import { BranchKeyStoreNode } from '../src/branch_keystore'
7-
import { SrkCompatibilityKmsConfig } from '../src/kms_config'
87
import {
98
constructAuthenticatedEncryptionContext,
109
constructBranchKeyMaterials,
@@ -69,7 +68,7 @@ const INVALID_CUSTOM_ENCRYPTION_CONTEXT_KV_PAIRS = {
6968
const BRANCH_KEYSTORE = new BranchKeyStoreNode({
7069
storage: { ddbTableName: DDB_TABLE_NAME },
7170
logicalKeyStoreName: LOGICAL_KEYSTORE_NAME,
72-
kmsConfiguration: new SrkCompatibilityKmsConfig(KEY_ARN),
71+
kmsConfiguration: { identifier: KEY_ARN },
7372
})
7473

7574
const BRANCH_KEY_STORAGE = BRANCH_KEYSTORE.storage as DynamoDBKeyStorage
@@ -497,7 +496,7 @@ describe('Test keystore helpers', () => {
497496
const branchKeyStore = new BranchKeyStoreNode({
498497
storage: { ddbTableName: DDB_TABLE_NAME },
499498
logicalKeyStoreName: LOGICAL_KEYSTORE_NAME,
500-
kmsConfiguration: new SrkCompatibilityKmsConfig(configArn),
499+
kmsConfiguration: { identifier: configArn },
501500
})
502501

503502
// create a real up-to-date active branch key record
@@ -524,7 +523,7 @@ describe('Test keystore helpers', () => {
524523
const branchKeyStore = new BranchKeyStoreNode({
525524
storage: { ddbTableName: DDB_TABLE_NAME },
526525
logicalKeyStoreName: LOGICAL_KEYSTORE_NAME,
527-
kmsConfiguration: new SrkCompatibilityKmsConfig(configArn),
526+
kmsConfiguration: { identifier: configArn },
528527
})
529528

530529
const activeBranchKeyRecord =

0 commit comments

Comments
 (0)