com.amazonaws.encryptionsdk.kmssdkv2

Class AwsKmsMrkAwareMasterKeyProvider.Builder

java.lang.Object

com.amazonaws.encryptionsdk.kmssdkv2.AwsKmsMrkAwareMasterKeyProvider.Builder

All Implemented Interfaces:

Cloneable

Enclosing class:

AwsKmsMrkAwareMasterKeyProvider

public static class AwsKmsMrkAwareMasterKeyProvider.Builder
extends Object
implements Cloneable

Method Summary

Modifier and Type	Method and Description
AwsKmsMrkAwareMasterKeyProvider	buildDiscovery() Builds the master key provider in Discovery Mode.
AwsKmsMrkAwareMasterKeyProvider	buildDiscovery(DiscoveryFilter filter) Builds the master key provider in Discovery Mode with a DiscoveryFilter.
AwsKmsMrkAwareMasterKeyProvider.Builder	builderSupplier(Supplier<software.amazon.awssdk.services.kms.KmsClientBuilder> supplier) Configures the AwsKmsMrkAwareMasterKeyProvider to use settings from this KmsClientBuilder to configure KMS clients.
AwsKmsMrkAwareMasterKeyProvider	buildStrict(List<String> keyIds) Builds the master key provider in Strict Mode.
AwsKmsMrkAwareMasterKeyProvider	buildStrict(String... keyIds) Builds the master key provider in strict mode.
AwsKmsMrkAwareMasterKeyProvider.Builder	clone()
AwsKmsMrkAwareMasterKeyProvider.Builder	customRegionalClientSupplier(RegionalClientSupplier regionalClientSupplier) Provides a custom factory function that will vend KMS clients.
AwsKmsMrkAwareMasterKeyProvider.Builder	defaultRegion(software.amazon.awssdk.regions.Region defaultRegion) Sets the default region.
AwsKmsMrkAwareMasterKeyProvider.Builder	discoveryMrkRegion(software.amazon.awssdk.regions.Region discoveryMrkRegion) Sets the region contacted for multi-region keys when in Discovery mode.

Methods inherited from class java.lang.Object

equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

clone

public AwsKmsMrkAwareMasterKeyProvider.Builder clone()

Overrides:

clone in class Object

defaultRegion

public AwsKmsMrkAwareMasterKeyProvider.Builder defaultRegion(software.amazon.awssdk.regions.Region defaultRegion)

Sets the default region. This region will be used when specifying key IDs for encryption or in MasterKeyProvider.getMasterKey(String) that are not full ARNs, but are instead bare key IDs or aliases.

If the default region is not specified, the AWS SDK default region will be used.

Parameters:

defaultRegion - The default region to use.

See Also:

KmsMasterKeyProvider.Builder.defaultRegion(Region)

discoveryMrkRegion

public AwsKmsMrkAwareMasterKeyProvider.Builder discoveryMrkRegion(software.amazon.awssdk.regions.Region discoveryMrkRegion)

Sets the region contacted for multi-region keys when in Discovery mode. This region will be used when a multi-region key is discovered on decrypt by MasterKeyProvider.getMasterKey(String).

Parameters:

discoveryMrkRegion - The region to contact to attempt to decrypt multi-region keys.

customRegionalClientSupplier

public AwsKmsMrkAwareMasterKeyProvider.Builder customRegionalClientSupplier(RegionalClientSupplier regionalClientSupplier)

Provides a custom factory function that will vend KMS clients. This is provided for advanced use cases which require complete control over the client construction process.

Because the regional client supplier fully controls the client construction process, it is not possible to configure the client through methods such as builderSupplier(Supplier); if you try to use these in combination, an IllegalStateException will be thrown.

Note: The AWS Encryption SDK for Java does not support the KmsAsyncClient interface.

See Also:

KmsMasterKeyProvider.Builder.customRegionalClientSupplier(RegionalClientSupplier)

builderSupplier

public AwsKmsMrkAwareMasterKeyProvider.Builder builderSupplier(Supplier<software.amazon.awssdk.services.kms.KmsClientBuilder> supplier)

Configures the AwsKmsMrkAwareMasterKeyProvider to use settings from this KmsClientBuilder to configure KMS clients. Note that the region set on this builder will be ignored, but all other settings will be propagated into the regional clients.

Note: The AWS Encryption SDK for Java does not support the KmsAsyncClient interface.

See Also:

KmsMasterKeyProvider.Builder.builderSupplier(Supplier)

buildDiscovery

public AwsKmsMrkAwareMasterKeyProvider buildDiscovery()

Builds the master key provider in Discovery Mode. In Discovery Mode the KMS Master Key Provider will attempt to decrypt using any key identifier it discovers in the encrypted message. KMS Master Key Providers in Discovery Mode will not encrypt data keys.

See Also:

KmsMasterKeyProvider.Builder.buildDiscovery()

buildDiscovery

public AwsKmsMrkAwareMasterKeyProvider buildDiscovery(DiscoveryFilter filter)

Builds the master key provider in Discovery Mode with a DiscoveryFilter. In Discovery Mode the KMS Master Key Provider will attempt to decrypt using any key identifier it discovers in the encrypted message that is accepted by the filter. KMS Master Key Providers in Discovery Mode will not encrypt data keys.

See Also:

KmsMasterKeyProvider.Builder.buildDiscovery(DiscoveryFilter)

buildStrict

public AwsKmsMrkAwareMasterKeyProvider buildStrict(List<String> keyIds)

Builds the master key provider in Strict Mode. KMS Master Key Providers in Strict Mode will only attempt to decrypt using key ARNs listed in keyIds. KMS Master Key Providers in Strict Mode will encrypt data keys using the keys listed in keyIds

In Strict Mode, one or more CMKs must be provided. For Master Key Providers that will only be used for encryption, you can use any valid KMS key identifier. For providers that will be used for decryption, you must use the key ARN; key ids, alias names, and alias ARNs are not supported.

See Also:

KmsMasterKeyProvider.Builder.buildStrict(List)

buildStrict

public AwsKmsMrkAwareMasterKeyProvider buildStrict(String... keyIds)

Builds the master key provider in strict mode. KMS Master Key Providers in Strict Mode will only attempt to decrypt using key ARNs listed in keyIds. KMS Master Key Providers in Strict Mode will encrypt data keys using the keys listed in keyIds

In Strict Mode, one or more CMKs must be provided. For Master Key Providers that will only be used for encryption, you can use any valid KMS key identifier. For providers that will be used for decryption, you must use the key ARN; key ids, alias names, and alias ARNs are not supported.

See Also:

KmsMasterKeyProvider.Builder.buildStrict(String...)