Java 类com.amazonaws.services.kms.AWSKMSClientBuilder 实例源码

private static void cleanUpKMSKeys(Regions testRegion, String testResourcePrefix, Date createdBeforeThreshold,
                                   AWSCredentialsProvider awsCredentials) {
    LOG.info("Cleaning KMS...");

    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withCredentials(awsCredentials)
            .withRegion(testRegion)
            .build();

    List<AliasListEntry> keys = kmsClient.listAliases().getAliases();
    for (AliasListEntry entry: keys) {
        if (!entry.getAliasName().startsWith("alias/" + testResourcePrefix)) {
            continue;
        }

        DescribeKeyRequest request = new DescribeKeyRequest().withKeyId(entry.getTargetKeyId());
        KeyMetadata metadata = kmsClient.describeKey(request).getKeyMetadata();

        if (KMSKeyState.fromString(metadata.getKeyState()) != KMSKeyState.PENDING_DELETION &&
                metadata.getCreationDate().before(createdBeforeThreshold)) {
            LOG.info("Scheduling KMS key for deletion:" + entry.getAliasName());
            scheduleKeyDeletion(kmsClient, entry);
        }
    }
}

LinkGeneratorLambdaHandler(String region, String jwtEncryptKeyArn, String pageStorageBucket, String authVerifyEndpointURL,
                           AWSCredentialsProvider awsCredential, String introPageTemplateName) throws IOException, TemplateException {
    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withCredentials(awsCredential)
            .withRegion(region)
            .build();
    AmazonS3 s3client = AmazonS3ClientBuilder
            .standard()
            .withCredentials(awsCredential)
            .withRegion(region)
            .build();
    kmsEncrypt = new KMSEncrypt(kmsClient, jwtEncryptKeyArn);
    this.pageStorageBucket = pageStorageBucket;
    this.authVerifyEndpointURL = authVerifyEndpointURL;
    this.pageUploader = new PageUploader(s3client, pageStorageBucket);


    this.introPageTemplate = new IntroPageTemplate(introPageTemplateName);
}

@Before
public void setUp() throws Exception {
    context = mock(Context.class);
    when(context.getLogger()).thenReturn(System.out::println);

    handler = new AuthLambdaHandler(TEST_AWS_REGION, TEST_JWT_KEY_ARN, TEST_VIDEO_STORAGE_BUCKET,
            TEST_USER_ACCESS_KEY_ID, TEST_USER_SECRET_ACCESS_KEY);

    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withRegion(TEST_AWS_REGION)
            .withCredentials(new AWSStaticCredentialsProvider(
                    new BasicAWSCredentials(TEST_USER_ACCESS_KEY_ID, TEST_USER_SECRET_ACCESS_KEY))
            )
            .build();
    kmsEncrypt = new KMSEncrypt(kmsClient, TEST_JWT_KEY_ARN);
}

private AWSKMSClientBuilder cloneClientBuilder(final AWSKMSClientBuilder builder) {
    // We need to copy all arguments out of the builder in case it's mutated later on.
    // Unfortunately AWSKMSClientBuilder doesn't support .clone() so we'll have to do it by hand.

    if (builder.getEndpoint() != null) {
        // We won't be able to set the region later if a custom endpoint is set.
        throw new IllegalArgumentException("Setting endpoint configuration is not compatible with passing a " +
                                           "builder to the KmsMasterKeyProvider. Use withCustomClientFactory" +
                                           " instead.");
    }

    final AWSKMSClientBuilder newBuilder = AWSKMSClient.builder();
    newBuilder.setClientConfiguration(builder.getClientConfiguration());
    newBuilder.setCredentials(builder.getCredentials());
    newBuilder.setEndpointConfiguration(builder.getEndpoint());
    newBuilder.setMetricsCollector(builder.getMetricsCollector());
    if (builder.getRequestHandlers() != null) {
        newBuilder.setRequestHandlers(builder.getRequestHandlers().toArray(new RequestHandler2[0]));
    }
    return newBuilder;
}

private RegionalClientSupplier clientFactory() {
    if (regionalClientSupplier_ != null) {
        return regionalClientSupplier_;
    }

    // Clone again; this MKP builder might be reused to build a second MKP with different creds.
    AWSKMSClientBuilder builder = templateBuilder_ != null ? cloneClientBuilder(templateBuilder_)
                                                           : AWSKMSClientBuilder.standard();

    ConcurrentHashMap<String, AWSKMS> clientCache = new ConcurrentHashMap<>();

    return region -> clientCache.computeIfAbsent(region, region2 -> {
        // Clone yet again as we're going to change the region field.
        return cloneClientBuilder(builder).withRegion(region2).build();
    });
}

public static String decrypt(String str, Region region) throws UnsupportedEncodingException {
  if (isJUnitTest()) {
    return str;
  }

  AWSKMS kms = AWSKMSClientBuilder.standard().withRegion(region.getName()).build();

  /*
   * The KMS ciphertext is base64 encoded and must be decoded before the request is made
   */
  String cipherString = str;
  byte[] cipherBytes = Base64.decode(cipherString);

  /*
   * Create decode request and decode
   */
  ByteBuffer cipherBuffer = ByteBuffer.wrap(cipherBytes);
  DecryptRequest req = new DecryptRequest().withCiphertextBlob(cipherBuffer);
  DecryptResult resp = kms.decrypt(req);

  /*
   * Convert the response plaintext bytes to a string
   */
  return new String(resp.getPlaintext().array(), Charset.forName("UTF-8"));
}

/**
 * Creates the KMS client {@link Bean}.
 *
 * Uses the default client, but if a region is unspecified, uses {@code us-east-1}.
 *
 * @return The KMS client.
 */
@Bean
public AWSKMS awsKms() {
    AWSKMS client = null;

    try {
        client = AWSKMSClientBuilder.defaultClient();
    } catch (SdkClientException exception) {
        API_LOG.info("Default KMS client failed to build, trying again with region us-east-1", exception);
        client = planB();
    }

    return client;
}

@Test
public void testDefaultClient() {
    mockStatic(AWSKMSClientBuilder.class);
    when(AWSKMSClientBuilder.defaultClient()).thenReturn(Mockito.mock(AWSKMS.class));
    Assert.assertNotNull(underTest.awsKms());
    verify(underTest, times(0)).planB();
}

@Test
public void testRegionClient() {
    mockStatic(AWSKMSClientBuilder.class);
    when(AWSKMSClientBuilder.defaultClient()).thenThrow(new SdkClientException("meep"));
    doAnswer(invocationOnMock -> null).when(underTest).planB();

    underTest.awsKms();
    verify(underTest, times(1)).planB();
}

public static KMSManager fromCredentials(AWSCredentialsProvider awsCredentials,
                                         ClientConfiguration clientConfiguration,
                                         SecretsGroupIdentifier groupIdentifier) {
    AWSKMS client = AWSKMSClientBuilder.standard()
        .withCredentials(awsCredentials)
        .withClientConfiguration(transformAndVerifyOrThrow(clientConfiguration))
        .withRegion(groupIdentifier.region.getName())
        .build();
    return new KMSManager(client, awsCredentials, clientConfiguration, groupIdentifier);
}

public KMSRandomGenerator(AWSCredentialsProvider awsCredentials, ClientConfiguration clientConfiguration) {
    this.client = AWSKMSClientBuilder.standard()
            .withCredentials(awsCredentials)
            .withClientConfiguration(transformAndVerifyOrThrow(clientConfiguration))
            .withRegion(RegionResolver.getRegion())
            .build();
}

public JWTKMSAuthorizer(String region, String jwtDecryptKeyARN, AWSCredentialsProvider credential) {
    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withRegion(region)
            .withCredentials(credential)
            .build();
    KMSDecrypt kmsDecrypt = new KMSDecrypt(kmsClient, Collections.singleton(jwtDecryptKeyARN));
    jwtDecoder = new JWTDecoder(kmsDecrypt);
}

private AWSKMS getClient() throws IOException {

        AWSKMSClientBuilder clientBuilder = AWSKMSClientBuilder.standard();

        ClientConfiguration clientConfig = PredefinedClientConfigurations.defaultConfig();

        String proxyHost = ConfigManager.getEnvironmentVariable(ConfigKeys.ProxyHost);
        if (proxyHost != null) {
            clientConfig.setProxyHost(proxyHost);
            clientConfig.setProxyPort(Integer.parseInt(ConfigManager.getEnvironmentVariable(ConfigKeys.ProxyPort)));
        }
        clientBuilder.setClientConfiguration(clientConfig);

        return clientBuilder.build();
    }

private String generateJWT() throws KeyOperationException {
    log.info("Generating JWT for user \"{}\" with journey \"{}\", valid for {} days", username, journey, expiresInDays);

    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withRegion(region)
            .build();

    KMSEncrypt kmsEncrypt = new KMSEncrypt(kmsClient, keyARN);
    Date expiryDate = expirationDate(expiresInDays);
    return JWTEncoder.builder(kmsEncrypt)
            .setExpiration(expiryDate)
            .claim("usr", username)
            .claim("jrn", journey)
            .compact();
}

/**
 * Configures the {@link KmsMasterKeyProvider} to use specific credentials. If a builder was previously set,
 * this will override whatever credentials it set.
 * @param credentialsProvider
 * @return
 */
public Builder withCredentials(AWSCredentialsProvider credentialsProvider) {
    if (regionalClientSupplier_ != null) {
        throw clientSupplierComboException();
    }

    if (templateBuilder_ == null) {
        templateBuilder_ = AWSKMSClientBuilder.standard();
    }

    templateBuilder_.setCredentials(credentialsProvider);

    return this;
}

/**
 * Configures the {@link KmsMasterKeyProvider} to use settings from this {@link AWSKMSClientBuilder} to
 * configure KMS clients. Note that the region set on this builder will be ignored, but all other settings
 * will be propagated into the regional clients.
 *
 * This method will overwrite any credentials set using {@link #withCredentials(AWSCredentialsProvider)}.
 *
 * @param builder
 * @return
 */
public Builder withClientBuilder(AWSKMSClientBuilder builder) {
    if (regionalClientSupplier_ != null) {
        throw clientSupplierComboException();
    }
    final AWSKMSClientBuilder newBuilder = cloneClientBuilder(builder);


    this.templateBuilder_ = newBuilder;

    return this;
}

/**
 * Returns an instance of this object with the supplied configuration and credentials. all keys
 * listed in {@code keyIds} will be used to protect data.
 */
public KmsMasterKeyProvider(final AWSCredentialsProvider creds, final Region region,
        final ClientConfiguration clientConfiguration, final List<String> keyIds) {
    this(builder().withClientBuilder(AWSKMSClientBuilder.standard()
                                                        .withClientConfiguration(clientConfiguration)
                                                        .withCredentials(creds))
                  .clientFactory(),
         region.getName(),
         keyIds
    );
}

public S3FileLoader(@Nonnull String bucketName, @Nonnull String key) {
    // Necessary to use *ClientBuilder for correct defaults (especially region selection).
    s3Client = AmazonS3ClientBuilder.defaultClient();
    kmsClient = AWSKMSClientBuilder.defaultClient();
    this.bucketName = bucketName;
    this.key = key;
}

public static AWSKMSClientBuilder builder() {
    return AWSKMSClientBuilder.standard();
}

@BeforeClass
public static void setUp() throws Exception {
    KMS_CLIENT = AWSKMSClientBuilder.standard()
            .withRegion(TEST_AWS_REGION)
            .build();
}

@BeforeClass
public static void setUp() throws Exception {
    KMS_CLIENT = AWSKMSClientBuilder.standard()
            .withRegion(TEST_AWS_REGION)
            .build();
}

public AwsPrivateKeyStore() {
   this(initAmazonS3(), AWSKMSClientBuilder.defaultClient());
   kmsDecrypt = Boolean.parseBoolean(System.getProperty(ATHENZ_PROP_AWS_KMS_DECRYPT, "false"));
}

@Bean
public AWSKMS kms(){
    final AWSKMSClientBuilder builder = AWSKMSClient.builder();
    Optional.ofNullable(properties.getRegion()).ifPresent(builder::setRegion);
    return builder.build();
}

/**
 * Returns the default client that uses {@code us-east-1}.
 *
 * @return The KMS client.
 */
AWSKMS planB() {
    return AWSKMSClientBuilder.standard().withRegion(Regions.US_EAST_1).build();
}

/**
 * Create an AWS KMS client.
 * @return Create new instance of builder with all defaults set with the DefaultAWSCredentialsProviderChain
 */
private AWSKMS getClient() {
    return AWSKMSClientBuilder.defaultClient();
}

/**
 * Create an AWS KMS client.
 * @return
 */
private AWSKMS getClient() {
    return AWSKMSClientBuilder.defaultClient();
}

/**
 * Create an AWS KMS client.
 * @return
 */
private AWSKMS getClient() {
    return AWSKMSClientBuilder.defaultClient();
}