You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: basics_scenarios/kms_scenario/SPECIFICATION.md
+95-84Lines changed: 95 additions & 84 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,10 @@
1
-
# AWS Key Management Service Scenario Specification
1
+
# AWS Key Management Service Basics Scenario Specification
2
2
3
3
## Overview
4
-
This SDK getting started scenario demonstrates how to interact with AWS Key Management Service (AWS KMS) using the AWS SDK. It demonstrates various tasks such as creating AWS KMS Keys, encrypting data, digitally signing data, creating aliases, tagging keys, and so on. Finally this scenario demonstrates how to clean up resources. Its purpose is to demonstrate how to get up and running with AWS KMS and the AWS SDK.
4
+
This SDK Basics scenario demonstrates how to interact with AWS Key Management Service (AWS KMS) using the AWS SDK. It demonstrates various tasks such as creating AWS KMS Keys, encrypting data, digitally signing data, creating aliases, tagging keys, and so on. Finally this scenario demonstrates how to clean up resources. Its purpose is to demonstrate how to get up and running with AWS KMS and the AWS SDK.
5
5
6
6
## Resources and User Input
7
-
The only required resource for this SDK getting started scenario is the grantee principal. The `GranteePrincipal` is the AWS Identity and Access Management (IAM) entity (user, role, or service) that is granted permission to perform specific actions.
7
+
The only required resource for this SDK Basics scenario is the grantee principal. The `GranteePrincipal` is the AWS Identity and Access Management (IAM) entity (user, role, or service) that is granted permission to perform specific actions.
8
8
9
9
## Hello AWS KSM
10
10
This program is intended for users not familiar with the AWS KSM SDK to easily get up and running. The logic is to show use of `KmsClient.listKeysPaginator()`.
@@ -18,26 +18,69 @@ The key ARN is: arn:aws:kms:us-west-2:123456789012:key/12345678-abcd-abcd-abcd-1
18
18
```
19
19
20
20
## Scenario Program Flow
21
-
The AWS Key Management SDK getting started scenario executes the following steps:
22
-
1. Creates an AWS KMS client.
23
-
2. Prompts the user to create an AWS KMS Symmetric key for encrypting and decrypting data.
24
-
3. Describes the newly created key.
25
-
4. Enables the AWS KMS key.
26
-
5. Encrypts the plaintext data using the KMS key.
27
-
6. Allows the user to create a custom alias for the KMS key.
28
-
7. Enables automatic rotation of the KMS key.
29
-
8. Grants permissions to an IAM principal to use the KMS key.
30
-
9. Lists the grants for the KMS key.
31
-
10. Revokes the previously created grant.
32
-
11. Decrypts the encrypted data using the KMS key.
33
-
12. Creates a key policy for the KMS key.
34
-
13. Retrieves the key policy.
35
-
14. Creates an AWS KMS Asymmetric key for signing and verifying data.
36
-
15. Signs and verifies data using the newly created key.
37
-
16. Tags the KMS key.
38
-
17. Prompts the user to delete the KMS resources.
39
-
18. If confirmed, deletes the custom alias, disables, and deletes the KMS key.
40
-
19. Concludes the AWS Key Management SDK getting started scenario.
21
+
22
+
The AWS Key Management SDK Basics scenario follows these steps:
23
+
24
+
1.**Create a Symmetric KMS Key**:
25
+
-**Description**: Creates a symmetric KMS key for encrypting and decrypting data. Use the `createKey` method.
26
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
27
+
28
+
2.**Enable a KMS Key**:
29
+
-**Description**: Checks if the KMS key is enabled. Use the `describeKey` method.
30
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
31
+
32
+
3.**Encrypt Data with the Symmetric KMS Key**:
33
+
-**Description**: Encrypts data using the symmetric KMS key. Use the `encrypt` method.
34
+
-**Exception Handling**: If a `DisabledException` is thrown (indicating the key is disabled), display the error message and terminate the program.
35
+
36
+
4.**Create an Alias**:
37
+
-**Description**: Creates an alias for the KMS key, prefixed with 'alias/'. Use the `createAlias` method.
38
+
-**Exception Handling**: If an `AlreadyExistsException` is thrown (indicating the alias already exists), display the message and continue execution.
39
+
40
+
5.**List All Aliases**:
41
+
-**Description**: Lists all KMS key aliases. Use the `listAliasesPaginator` method (or a standard list method if pagination is unavailable).
42
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
43
+
44
+
6.**Enable Automatic Rotation for the KMS Key**:
45
+
-**Description**: Enables automatic key rotation. Use the `enableKeyRotation` method.
46
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
47
+
48
+
7.**Create a Grant**:
49
+
-**Description**: Creates a grant for the KMS key. Use the `createGrant` method.
50
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
51
+
52
+
8.**List Grants for the KMS Key**:
53
+
-**Description**: Lists all grants associated with the KMS key. Use the `listGrantsPaginator` method (or a standard list method if pagination is unavailable).
54
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
55
+
56
+
9.**Revoke a Grant**:
57
+
-**Description**: Revokes a specific grant for the KMS key. Use the `revokeGrant` method.
58
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
59
+
60
+
10.**Decrypt the Data**:
61
+
-**Description**: Decrypts previously encrypted data using the KMS key. Use the `decrypt` method.
62
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
63
+
64
+
11.**Replace a Key Policy**:
65
+
-**Description**: Replaces the key policy for the KMS key. Use the `putKeyPolicy` method.
66
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
67
+
68
+
12.**Retrieve the Key Policy**:
69
+
-**Description**: Retrieves the key policy for the KMS key. Use the `getKeyPolicy` method.
70
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
71
+
72
+
13.**Create an Asymmetric KMS Key and Sign Data**:
73
+
-**Description**: Creates an asymmetric KMS key and uses it to sign data. Use the `createKey` method and the `sign` method.
74
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
75
+
76
+
14.**Tag the Symmetric KMS Key**:
77
+
-**Description**: Tags the symmetric KMS key. Use the `tagResource` method.
78
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
79
+
80
+
15.**Schedule the Deletion of the KMS Key**:
81
+
-**Description**: Schedules the deletion of the KMS key. Ensure users are aware of the warning associated with key deletion (refer to the Java implementation). Invoke the following methods in order: `deleteAlias`, `disableKey`, and `scheduleKeyDeletion`.
82
+
-**Exception Handling**: If a `KmsException` is thrown, display the error message and terminate the program.
83
+
41
84
42
85
### Program execution
43
86
The following shows the output of the program in the console.
@@ -56,22 +99,19 @@ and an asymmetric key used to digitally sign data.
0 commit comments