@@ -110,13 +110,13 @@ public static void encryptAndDecryptWithKeyring(
110110 final ICryptographicMaterialsCache sharedCryptographicMaterialsCache =
111111 matProv .CreateCryptographicMaterialsCache (cryptographicMaterialsCacheInput );
112112
113- // Create a CacheType object for the sharedCryptographicMaterialsCache
113+ // Create a CacheType object for the sharedCryptographicMaterialsCache
114114 // Note that the `cache` parameter in the Hierarchical Keyring Input takes a `CacheType` as input
115115 final CacheType sharedCache =
116- CacheType .builder ()
117- // This is the `Shared` CacheType that passes an already initialized shared cache
118- .Shared (sharedCryptographicMaterialsCache )
119- .build ();
116+ CacheType .builder ()
117+ // This is the `Shared` CacheType that passes an already initialized shared cache
118+ .Shared (sharedCryptographicMaterialsCache )
119+ .build ();
120120
121121 // Instantiate the SDK
122122 // This builds the AwsCrypto client with the RequireEncryptRequireDecrypt commitment policy,
@@ -133,7 +133,7 @@ public static void encryptAndDecryptWithKeyring(
133133 // to initially create and populate your physical KeyStore.
134134 // Note that ddbTableName keyStoreTableName is the physical Key Store,
135135 // and keystore1 is instances of this physical Key Store.
136- final KeyStore keystore1 =
136+ final KeyStore keystore1 =
137137 KeyStore .builder ()
138138 .KeyStoreConfig (
139139 KeyStoreConfig .builder ()
@@ -150,17 +150,17 @@ public static void encryptAndDecryptWithKeyring(
150150 keystore1 .CreateKey (CreateKeyInput .builder ().build ()).branchKeyIdentifier ();
151151
152152 // Create the Hierarchical Keyring HK1 with Key Store instance K1, partitionId,
153- // the shared Cache and the BranchKeyId.
154- // Note that we are now providing an already initialized shared cache instead of just mentioning
155- // the cache type and the Hierarchical Keyring initializing a cache at initialization.
153+ // the shared Cache and the BranchKeyId.
154+ // Note that we are now providing an already initialized shared cache instead of just mentioning
155+ // the cache type and the Hierarchical Keyring initializing a cache at initialization.
156156 final CreateAwsKmsHierarchicalKeyringInput keyringInput1 =
157157 CreateAwsKmsHierarchicalKeyringInput .builder ()
158- .keyStore (keystore1 )
159- .branchKeyId (branchKeyId )
160- .ttlSeconds (600 )
161- .cache (sharedCache )
162- .partitionId (partitionId )
163- .build ();
158+ .keyStore (keystore1 )
159+ .branchKeyId (branchKeyId )
160+ .ttlSeconds (600 )
161+ .cache (sharedCache )
162+ .partitionId (partitionId )
163+ .build ();
164164 final IKeyring hierarchicalKeyring1 = matProv .CreateAwsKmsHierarchicalKeyring (keyringInput1 );
165165
166166 // Create example encryption context
@@ -180,54 +180,55 @@ public static void encryptAndDecryptWithKeyring(
180180 crypto .decryptData (hierarchicalKeyring1 , encryptResult1 .getResult ());
181181 assert Arrays .equals (decryptResult1 .getResult (), EXAMPLE_DATA );
182182
183- // Through the above encrypt and decrypt roundtrip, the cache will be populated and
184- // the cache entries can be used by another Hierarchical Keyring with the
185- // - Same Partition ID
186- // - Same Logical Key Store Name of the Key Store for the Hierarchical Keyring
187- // - Same Branch Key ID
188-
189- // Configure your KeyStore resource keystore2.
190- // This SHOULD be the same configuration that you used
191- // to initially create and populate your physical KeyStore.
192- // Note that ddbTableName keyStoreTableName is the physical Key Store,
193- // and keystore2 is instances of this physical Key Store.
194-
195- // Note that for this example, keystore2 is identical to keystore1.
196- // You can optionally change configurations like KMS Client or KMS Key ID based
197- // on your use-case.
198- // Make sure you have the required permissions to use different configurations.
199-
200- // - If you want to share cache entries across two keyrings HK1 and HK2,
201- // you should set the Logical Key Store Names for both
202- // Key Store instances (K1 and K2) to be the same.
203- // - If you set the Logical Key Store Names for K1 and K2 to be different,
204- // HK1 (which uses Key Store instance K1) and HK2 (which uses Key Store
205- // instance K2) will NOT be able to share cache entries.
206- final KeyStore keystore2 =
207- KeyStore .builder ()
208- .KeyStoreConfig (
209- KeyStoreConfig .builder ()
210- .ddbClient (DynamoDbClient .create ())
211- .ddbTableName (keyStoreTableName )
212- .logicalKeyStoreName (logicalKeyStoreName )
213- .kmsClient (KmsClient .create ())
214- .kmsConfiguration (KMSConfiguration .builder ().kmsKeyArn (kmsKeyId ).build ())
215- .build ())
216- .build ();
183+ // Through the above encrypt and decrypt roundtrip, the cache will be populated and
184+ // the cache entries can be used by another Hierarchical Keyring with the
185+ // - Same Partition ID
186+ // - Same Logical Key Store Name of the Key Store for the Hierarchical Keyring
187+ // - Same Branch Key ID
188+
189+ // Configure your KeyStore resource keystore2.
190+ // This SHOULD be the same configuration that you used
191+ // to initially create and populate your physical KeyStore.
192+ // Note that ddbTableName keyStoreTableName is the physical Key Store,
193+ // and keystore2 is instances of this physical Key Store.
194+
195+ // Note that for this example, keystore2 is identical to keystore1.
196+ // You can optionally change configurations like KMS Client or KMS Key ID based
197+ // on your use-case.
198+ // Make sure you have the required permissions to use different configurations.
199+
200+ // - If you want to share cache entries across two keyrings HK1 and HK2,
201+ // you should set the Logical Key Store Names for both
202+ // Key Store instances (K1 and K2) to be the same.
203+ // - If you set the Logical Key Store Names for K1 and K2 to be different,
204+ // HK1 (which uses Key Store instance K1) and HK2 (which uses Key Store
205+ // instance K2) will NOT be able to share cache entries.
206+ final KeyStore keystore2 =
207+ KeyStore .builder ()
208+ .KeyStoreConfig (
209+ KeyStoreConfig .builder ()
210+ .ddbClient (DynamoDbClient .create ())
211+ .ddbTableName (keyStoreTableName )
212+ .logicalKeyStoreName (logicalKeyStoreName )
213+ .kmsClient (KmsClient .create ())
214+ .kmsConfiguration (KMSConfiguration .builder ().kmsKeyArn (kmsKeyId ).build ())
215+ .build ())
216+ .build ();
217217
218218 // Create the Hierarchical Keyring HK2 with Key Store instance K2, the shared Cache
219- // and the same partitionId and BranchKeyId used in HK1 because we want to share cache entries
220- // (and experience cache HITS).
219+ // and the same partitionId and BranchKeyId used in HK1 because we want to share cache entries
220+ // (and experience cache HITS).
221221 final CreateAwsKmsHierarchicalKeyringInput keyringInput2 =
222- CreateAwsKmsHierarchicalKeyringInput .builder ()
223- .keyStore (keystore2 )
224- .branchKeyId (branchKeyId )
225- .ttlSeconds (600 )
226- .cache (sharedCache )
227- .partitionId (partitionId )
228- .build ();
229- final IKeyring hierarchicalKeyring2 = matProv .CreateAwsKmsHierarchicalKeyring (keyringInput2 );
230-
222+ CreateAwsKmsHierarchicalKeyringInput .builder ()
223+ .keyStore (keystore2 )
224+ .branchKeyId (branchKeyId )
225+ .ttlSeconds (600 )
226+ .cache (sharedCache )
227+ .partitionId (partitionId )
228+ .build ();
229+ final IKeyring hierarchicalKeyring2 = matProv .CreateAwsKmsHierarchicalKeyring (keyringInput2 );
230+
231+ // This encrypt-decrypt roundtrip with HK2 will experience Cache HITS from previous HK1 roundtrip
231232 // Encrypt the data for encryptionContext using hierarchicalKeyring2
232233 final CryptoResult <byte [], ?> encryptResult2 =
233234 crypto .encryptData (hierarchicalKeyring2 , EXAMPLE_DATA , encryptionContext );
0 commit comments