Java AWSKMSClientBuilder类代码示例

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
public static String decrypt(String str, Region region) throws UnsupportedEncodingException {
  if (isJUnitTest()) {
    return str;
  }

  AWSKMS kms = AWSKMSClientBuilder.standard().withRegion(region.getName()).build();

  /*
   * The KMS ciphertext is base64 encoded and must be decoded before the request is made
   */
  String cipherString = str;
  byte[] cipherBytes = Base64.decode(cipherString);

  /*
   * Create decode request and decode
   */
  ByteBuffer cipherBuffer = ByteBuffer.wrap(cipherBytes);
  DecryptRequest req = new DecryptRequest().withCiphertextBlob(cipherBuffer);
  DecryptResult resp = kms.decrypt(req);

  /*
   * Convert the response plaintext bytes to a string
   */
  return new String(resp.getPlaintext().array(), Charset.forName("UTF-8"));
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
private static void cleanUpKMSKeys(Regions testRegion, String testResourcePrefix, Date createdBeforeThreshold,
                                   AWSCredentialsProvider awsCredentials) {
    LOG.info("Cleaning KMS...");

    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withCredentials(awsCredentials)
            .withRegion(testRegion)
            .build();

    List<AliasListEntry> keys = kmsClient.listAliases().getAliases();
    for (AliasListEntry entry: keys) {
        if (!entry.getAliasName().startsWith("alias/" + testResourcePrefix)) {
            continue;
        }

        DescribeKeyRequest request = new DescribeKeyRequest().withKeyId(entry.getTargetKeyId());
        KeyMetadata metadata = kmsClient.describeKey(request).getKeyMetadata();

        if (KMSKeyState.fromString(metadata.getKeyState()) != KMSKeyState.PENDING_DELETION &&
                metadata.getCreationDate().before(createdBeforeThreshold)) {
            LOG.info("Scheduling KMS key for deletion:" + entry.getAliasName());
            scheduleKeyDeletion(kmsClient, entry);
        }
    }
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
LinkGeneratorLambdaHandler(String region, String jwtEncryptKeyArn, String pageStorageBucket, String authVerifyEndpointURL,
                           AWSCredentialsProvider awsCredential, String introPageTemplateName) throws IOException, TemplateException {
    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withCredentials(awsCredential)
            .withRegion(region)
            .build();
    AmazonS3 s3client = AmazonS3ClientBuilder
            .standard()
            .withCredentials(awsCredential)
            .withRegion(region)
            .build();
    kmsEncrypt = new KMSEncrypt(kmsClient, jwtEncryptKeyArn);
    this.pageStorageBucket = pageStorageBucket;
    this.authVerifyEndpointURL = authVerifyEndpointURL;
    this.pageUploader = new PageUploader(s3client, pageStorageBucket);


    this.introPageTemplate = new IntroPageTemplate(introPageTemplateName);
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
@Before
public void setUp() throws Exception {
    context = mock(Context.class);
    when(context.getLogger()).thenReturn(System.out::println);

    handler = new AuthLambdaHandler(TEST_AWS_REGION, TEST_JWT_KEY_ARN, TEST_VIDEO_STORAGE_BUCKET,
            TEST_USER_ACCESS_KEY_ID, TEST_USER_SECRET_ACCESS_KEY);

    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withRegion(TEST_AWS_REGION)
            .withCredentials(new AWSStaticCredentialsProvider(
                    new BasicAWSCredentials(TEST_USER_ACCESS_KEY_ID, TEST_USER_SECRET_ACCESS_KEY))
            )
            .build();
    kmsEncrypt = new KMSEncrypt(kmsClient, TEST_JWT_KEY_ARN);
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
private AWSKMSClientBuilder cloneClientBuilder(final AWSKMSClientBuilder builder) {
    // We need to copy all arguments out of the builder in case it's mutated later on.
    // Unfortunately AWSKMSClientBuilder doesn't support .clone() so we'll have to do it by hand.

    if (builder.getEndpoint() != null) {
        // We won't be able to set the region later if a custom endpoint is set.
        throw new IllegalArgumentException("Setting endpoint configuration is not compatible with passing a " +
                                           "builder to the KmsMasterKeyProvider. Use withCustomClientFactory" +
                                           " instead.");
    }

    final AWSKMSClientBuilder newBuilder = AWSKMSClient.builder();
    newBuilder.setClientConfiguration(builder.getClientConfiguration());
    newBuilder.setCredentials(builder.getCredentials());
    newBuilder.setEndpointConfiguration(builder.getEndpoint());
    newBuilder.setMetricsCollector(builder.getMetricsCollector());
    if (builder.getRequestHandlers() != null) {
        newBuilder.setRequestHandlers(builder.getRequestHandlers().toArray(new RequestHandler2[0]));
    }
    return newBuilder;
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
private RegionalClientSupplier clientFactory() {
    if (regionalClientSupplier_ != null) {
        return regionalClientSupplier_;
    }

    // Clone again; this MKP builder might be reused to build a second MKP with different creds.
    AWSKMSClientBuilder builder = templateBuilder_ != null ? cloneClientBuilder(templateBuilder_)
                                                           : AWSKMSClientBuilder.standard();

    ConcurrentHashMap<String, AWSKMS> clientCache = new ConcurrentHashMap<>();

    return region -> clientCache.computeIfAbsent(region, region2 -> {
        // Clone yet again as we're going to change the region field.
        return cloneClientBuilder(builder).withRegion(region2).build();
    });
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
/**
 * Creates the KMS client {@link Bean}.
 *
 * Uses the default client, but if a region is unspecified, uses {@code us-east-1}.
 *
 * @return The KMS client.
 */
@Bean
public AWSKMS awsKms() {
	AWSKMS client = null;

	try {
		client = AWSKMSClientBuilder.defaultClient();
	} catch (SdkClientException exception) {
		API_LOG.info("Default KMS client failed to build, trying again with region us-east-1", exception);
		client = planB();
	}

	return client;
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
@Test
public void testDefaultClient() {
	mockStatic(AWSKMSClientBuilder.class);
	when(AWSKMSClientBuilder.defaultClient()).thenReturn(Mockito.mock(AWSKMS.class));
	Assert.assertNotNull(underTest.awsKms());
	verify(underTest, times(0)).planB();
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
@Test
public void testRegionClient() {
	mockStatic(AWSKMSClientBuilder.class);
	when(AWSKMSClientBuilder.defaultClient()).thenThrow(new SdkClientException("meep"));
	doAnswer(invocationOnMock -> null).when(underTest).planB();

	underTest.awsKms();
	verify(underTest, times(1)).planB();
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
public static KMSManager fromCredentials(AWSCredentialsProvider awsCredentials,
                                         ClientConfiguration clientConfiguration,
                                         SecretsGroupIdentifier groupIdentifier) {
    AWSKMS client = AWSKMSClientBuilder.standard()
        .withCredentials(awsCredentials)
        .withClientConfiguration(transformAndVerifyOrThrow(clientConfiguration))
        .withRegion(groupIdentifier.region.getName())
        .build();
    return new KMSManager(client, awsCredentials, clientConfiguration, groupIdentifier);
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
public KMSRandomGenerator(AWSCredentialsProvider awsCredentials, ClientConfiguration clientConfiguration) {
    this.client = AWSKMSClientBuilder.standard()
            .withCredentials(awsCredentials)
            .withClientConfiguration(transformAndVerifyOrThrow(clientConfiguration))
            .withRegion(RegionResolver.getRegion())
            .build();
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
public JWTKMSAuthorizer(String region, String jwtDecryptKeyARN, AWSCredentialsProvider credential) {
    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withRegion(region)
            .withCredentials(credential)
            .build();
    KMSDecrypt kmsDecrypt = new KMSDecrypt(kmsClient, Collections.singleton(jwtDecryptKeyARN));
    jwtDecoder = new JWTDecoder(kmsDecrypt);
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
private AWSKMS getClient() throws IOException {

        AWSKMSClientBuilder clientBuilder = AWSKMSClientBuilder.standard();

        ClientConfiguration clientConfig = PredefinedClientConfigurations.defaultConfig();

        String proxyHost = ConfigManager.getEnvironmentVariable(ConfigKeys.ProxyHost);
        if (proxyHost != null) {
            clientConfig.setProxyHost(proxyHost);
            clientConfig.setProxyPort(Integer.parseInt(ConfigManager.getEnvironmentVariable(ConfigKeys.ProxyPort)));
        }
        clientBuilder.setClientConfiguration(clientConfig);

        return clientBuilder.build();
    }
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
private String generateJWT() throws KeyOperationException {
    log.info("Generating JWT for user \"{}\" with journey \"{}\", valid for {} days", username, journey, expiresInDays);

    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withRegion(region)
            .build();

    KMSEncrypt kmsEncrypt = new KMSEncrypt(kmsClient, keyARN);
    Date expiryDate = expirationDate(expiresInDays);
    return JWTEncoder.builder(kmsEncrypt)
            .setExpiration(expiryDate)
            .claim("usr", username)
            .claim("jrn", journey)
            .compact();
}
 

import com.amazonaws.services.kms.AWSKMSClientBuilder; //导入依赖的package包/类
/**
 * Configures the {@link KmsMasterKeyProvider} to use specific credentials. If a builder was previously set,
 * this will override whatever credentials it set.
 * @param credentialsProvider
 * @return
 */
public Builder withCredentials(AWSCredentialsProvider credentialsProvider) {
    if (regionalClientSupplier_ != null) {
        throw clientSupplierComboException();
    }

    if (templateBuilder_ == null) {
        templateBuilder_ = AWSKMSClientBuilder.standard();
    }

    templateBuilder_.setCredentials(credentialsProvider);

    return this;
}