Skip to content

Resolve issue #68 #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
juneb wants to merge 1 commit into from
Closed

Resolve issue #68 #69

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions framework/kms-keyring.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,21 +74,21 @@ The keyring will use this client supplier to determine the KMS client to use whe

### Key IDs

Key IDs is a list of strings identifying KMS CMKs, in ARN format.
Key IDs is a list of strings identifying AWS KMS customer master keys (CMKs).
This list identifies the CMKs to be used for data key encryption and decryption with this keyring.

Each Key ID MUST be one of the following:

- A CMK [alias](https://docs.aws.amazon.com/kms/latest/developerguide/programming-aliases.html) (e.g. "alias/MyCryptoKey")
- A well-formed key ARN (e.g. arn:aws:kms:us-east-1:999999999999:key/01234567-89ab-cdef-fedc-ba9876543210)
- A well-formned alias ARN (e.g. arn:aws:kms:us-east-1:999999999999:alias/MyCryptoKey)
- A [alias name](https://docs.aws.amazon.com/kms/latest/developerguide/programming-aliases.html) (e.g. "alias/MyCryptoKey")
- A key ARN (e.g. arn:aws:kms:us-east-1:999999999999:key/01234567-89ab-cdef-fedc-ba9876543210)
- A alias ARN (e.g. arn:aws:kms:us-east-1:999999999999:alias/MyCryptoKey)

See [AWS Documentation](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-kms).

Note that only key IDs in the key ARN format will ever be used for decryption.
This is because encrypted data keys constructed by the KMS keyring will always store the ID of the
CMK used to encrypt it in key ARN format, and [OnDecrypt](#ondecrypt) checks the key ID against that
value before attempting decryption.
In a keyring used for decryption, CMKs must be identified by a key ARN.
[OnDecrypt](#ondecrypt) tries to match a CMK in the decryption keyring to the CMK that encrypted a data key. Because the CMKs that encrypted data keys are identified
by key ARNs, the CMKs in the decryption keyring match only when they are also identified by key ARNs.


The KMS CMK specified by the Key ID MUST have
[kms:Encrypt](https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html#AWS-KMS-API-Operations-and-Permissions)
Expand Down