821 lines
33 KiB
Python
821 lines
33 KiB
Python
# Copyright (c) 2014 Amazon.com, Inc. or its affiliates. All Rights Reserved
|
|
#
|
|
# Permission is hereby granted, free of charge, to any person obtaining a
|
|
# copy of this software and associated documentation files (the
|
|
# "Software"), to deal in the Software without restriction, including
|
|
# without limitation the rights to use, copy, modify, merge, publish, dis-
|
|
# tribute, sublicense, and/or sell copies of the Software, and to permit
|
|
# persons to whom the Software is furnished to do so, subject to the fol-
|
|
# lowing conditions:
|
|
#
|
|
# The above copyright notice and this permission notice shall be included
|
|
# in all copies or substantial portions of the Software.
|
|
#
|
|
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|
# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABIL-
|
|
# ITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
|
|
# SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
|
# IN THE SOFTWARE.
|
|
#
|
|
|
|
import boto
|
|
from boto.compat import json
|
|
from boto.connection import AWSQueryConnection
|
|
from boto.regioninfo import RegionInfo
|
|
from boto.exception import JSONResponseError
|
|
from boto.kms import exceptions
|
|
from boto.compat import six
|
|
import base64
|
|
|
|
|
|
class KMSConnection(AWSQueryConnection):
|
|
"""
|
|
AWS Key Management Service
|
|
AWS Key Management Service (KMS) is an encryption and key
|
|
management web service. This guide describes the KMS actions that
|
|
you can call programmatically. For general information about KMS,
|
|
see (need an address here). For the KMS developer guide, see (need
|
|
address here).
|
|
|
|
AWS provides SDKs that consist of libraries and sample code for
|
|
various programming languages and platforms (Java, Ruby, .Net,
|
|
iOS, Android, etc.). The SDKs provide a convenient way to create
|
|
programmatic access to KMS and AWS. For example, the SDKs take
|
|
care of tasks such as signing requests (see below), managing
|
|
errors, and retrying requests automatically. For more information
|
|
about the AWS SDKs, including how to download and install them,
|
|
see `Tools for Amazon Web Services`_.
|
|
|
|
We recommend that you use the AWS SDKs to make programmatic API
|
|
calls to KMS. However, you can also use the KMS Query API to make
|
|
to make direct calls to the KMS web service.
|
|
|
|
**Signing Requests**
|
|
|
|
Requests must be signed by using an access key ID and a secret
|
|
access key. We strongly recommend that you do not use your AWS
|
|
account access key ID and secret key for everyday work with KMS.
|
|
Instead, use the access key ID and secret access key for an IAM
|
|
user, or you can use the AWS Security Token Service to generate
|
|
temporary security credentials that you can use to sign requests.
|
|
|
|
All KMS operations require `Signature Version 4`_.
|
|
|
|
**Recording API Requests**
|
|
|
|
KMS supports AWS CloudTrail, a service that records AWS API calls
|
|
and related events for your AWS account and delivers them to an
|
|
Amazon S3 bucket that you specify. By using the information
|
|
collected by CloudTrail, you can determine what requests were made
|
|
to KMS, who made the request, when it was made, and so on. To
|
|
learn more about CloudTrail, including how to turn it on and find
|
|
your log files, see the `AWS CloudTrail User Guide`_
|
|
|
|
**Additional Resources**
|
|
|
|
For more information about credentials and request signing, see
|
|
the following:
|
|
|
|
|
|
+ `AWS Security Credentials`_. This topic provides general
|
|
information about the types of credentials used for accessing AWS.
|
|
+ `AWS Security Token Service`_. This guide describes how to
|
|
create and use temporary security credentials.
|
|
+ `Signing AWS API Requests`_. This set of topics walks you
|
|
through the process of signing a request using an access key ID
|
|
and a secret access key.
|
|
"""
|
|
APIVersion = "2014-11-01"
|
|
DefaultRegionName = "us-east-1"
|
|
DefaultRegionEndpoint = "kms.us-east-1.amazonaws.com"
|
|
ServiceName = "KMS"
|
|
TargetPrefix = "TrentService"
|
|
ResponseError = JSONResponseError
|
|
|
|
_faults = {
|
|
"InvalidGrantTokenException": exceptions.InvalidGrantTokenException,
|
|
"DisabledException": exceptions.DisabledException,
|
|
"LimitExceededException": exceptions.LimitExceededException,
|
|
"DependencyTimeoutException": exceptions.DependencyTimeoutException,
|
|
"InvalidMarkerException": exceptions.InvalidMarkerException,
|
|
"AlreadyExistsException": exceptions.AlreadyExistsException,
|
|
"InvalidCiphertextException": exceptions.InvalidCiphertextException,
|
|
"KeyUnavailableException": exceptions.KeyUnavailableException,
|
|
"InvalidAliasNameException": exceptions.InvalidAliasNameException,
|
|
"UnsupportedOperationException": exceptions.UnsupportedOperationException,
|
|
"InvalidArnException": exceptions.InvalidArnException,
|
|
"KMSInternalException": exceptions.KMSInternalException,
|
|
"InvalidKeyUsageException": exceptions.InvalidKeyUsageException,
|
|
"MalformedPolicyDocumentException": exceptions.MalformedPolicyDocumentException,
|
|
"NotFoundException": exceptions.NotFoundException,
|
|
}
|
|
|
|
|
|
def __init__(self, **kwargs):
|
|
region = kwargs.pop('region', None)
|
|
if not region:
|
|
region = RegionInfo(self, self.DefaultRegionName,
|
|
self.DefaultRegionEndpoint)
|
|
|
|
if 'host' not in kwargs or kwargs['host'] is None:
|
|
kwargs['host'] = region.endpoint
|
|
|
|
super(KMSConnection, self).__init__(**kwargs)
|
|
self.region = region
|
|
|
|
def _required_auth_capability(self):
|
|
return ['hmac-v4']
|
|
|
|
def create_alias(self, alias_name, target_key_id):
|
|
"""
|
|
Creates a display name for a customer master key. An alias can
|
|
be used to identify a key and should be unique. The console
|
|
enforces a one-to-one mapping between the alias and a key. An
|
|
alias name can contain only alphanumeric characters, forward
|
|
slashes (/), underscores (_), and dashes (-). An alias must
|
|
start with the word "alias" followed by a forward slash
|
|
(alias/). An alias that begins with "aws" after the forward
|
|
slash (alias/aws...) is reserved by Amazon Web Services (AWS).
|
|
|
|
:type alias_name: string
|
|
:param alias_name: String that contains the display name. Aliases that
|
|
begin with AWS are reserved.
|
|
|
|
:type target_key_id: string
|
|
:param target_key_id: An identifier of the key for which you are
|
|
creating the alias. This value cannot be another alias.
|
|
|
|
"""
|
|
params = {
|
|
'AliasName': alias_name,
|
|
'TargetKeyId': target_key_id,
|
|
}
|
|
return self.make_request(action='CreateAlias',
|
|
body=json.dumps(params))
|
|
|
|
def create_grant(self, key_id, grantee_principal,
|
|
retiring_principal=None, operations=None,
|
|
constraints=None, grant_tokens=None):
|
|
"""
|
|
Adds a grant to a key to specify who can access the key and
|
|
under what conditions. Grants are alternate permission
|
|
mechanisms to key policies. If absent, access to the key is
|
|
evaluated based on IAM policies attached to the user. By
|
|
default, grants do not expire. Grants can be listed, retired,
|
|
or revoked as indicated by the following APIs. Typically, when
|
|
you are finished using a grant, you retire it. When you want
|
|
to end a grant immediately, revoke it. For more information
|
|
about grants, see `Grants`_.
|
|
|
|
#. ListGrants
|
|
#. RetireGrant
|
|
#. RevokeGrant
|
|
|
|
:type key_id: string
|
|
:param key_id: A unique key identifier for a customer master key. This
|
|
value can be a globally unique identifier, an ARN, or an alias.
|
|
|
|
:type grantee_principal: string
|
|
:param grantee_principal: Principal given permission by the grant to
|
|
use the key identified by the `keyId` parameter.
|
|
|
|
:type retiring_principal: string
|
|
:param retiring_principal: Principal given permission to retire the
|
|
grant. For more information, see RetireGrant.
|
|
|
|
:type operations: list
|
|
:param operations: List of operations permitted by the grant. This can
|
|
be any combination of one or more of the following values:
|
|
|
|
#. Decrypt
|
|
#. Encrypt
|
|
#. GenerateDataKey
|
|
#. GenerateDataKeyWithoutPlaintext
|
|
#. ReEncryptFrom
|
|
#. ReEncryptTo
|
|
#. CreateGrant
|
|
|
|
:type constraints: dict
|
|
:param constraints: Specifies the conditions under which the actions
|
|
specified by the `Operations` parameter are allowed.
|
|
|
|
:type grant_tokens: list
|
|
:param grant_tokens: List of grant tokens.
|
|
|
|
"""
|
|
params = {
|
|
'KeyId': key_id,
|
|
'GranteePrincipal': grantee_principal,
|
|
}
|
|
if retiring_principal is not None:
|
|
params['RetiringPrincipal'] = retiring_principal
|
|
if operations is not None:
|
|
params['Operations'] = operations
|
|
if constraints is not None:
|
|
params['Constraints'] = constraints
|
|
if grant_tokens is not None:
|
|
params['GrantTokens'] = grant_tokens
|
|
return self.make_request(action='CreateGrant',
|
|
body=json.dumps(params))
|
|
|
|
def create_key(self, policy=None, description=None, key_usage=None):
|
|
"""
|
|
Creates a customer master key. Customer master keys can be
|
|
used to encrypt small amounts of data (less than 4K) directly,
|
|
but they are most commonly used to encrypt or envelope data
|
|
keys that are then used to encrypt customer data. For more
|
|
information about data keys, see GenerateDataKey and
|
|
GenerateDataKeyWithoutPlaintext.
|
|
|
|
:type policy: string
|
|
:param policy: Policy to be attached to the key. This is required and
|
|
delegates back to the account. The key is the root of trust.
|
|
|
|
:type description: string
|
|
:param description: Description of the key. We recommend that you
|
|
choose a description that helps your customer decide whether the
|
|
key is appropriate for a task.
|
|
|
|
:type key_usage: string
|
|
:param key_usage: Specifies the intended use of the key. Currently this
|
|
defaults to ENCRYPT/DECRYPT, and only symmetric encryption and
|
|
decryption are supported.
|
|
|
|
"""
|
|
params = {}
|
|
if policy is not None:
|
|
params['Policy'] = policy
|
|
if description is not None:
|
|
params['Description'] = description
|
|
if key_usage is not None:
|
|
params['KeyUsage'] = key_usage
|
|
return self.make_request(action='CreateKey',
|
|
body=json.dumps(params))
|
|
|
|
def decrypt(self, ciphertext_blob, encryption_context=None,
|
|
grant_tokens=None):
|
|
"""
|
|
Decrypts ciphertext. Ciphertext is plaintext that has been
|
|
previously encrypted by using the Encrypt function.
|
|
|
|
:type ciphertext_blob: blob
|
|
:param ciphertext_blob: Ciphertext including metadata.
|
|
|
|
:type encryption_context: map
|
|
:param encryption_context: The encryption context. If this was
|
|
specified in the Encrypt function, it must be specified here or the
|
|
decryption operation will fail. For more information, see
|
|
`Encryption Context`_.
|
|
|
|
:type grant_tokens: list
|
|
:param grant_tokens: A list of grant tokens that represent grants which
|
|
can be used to provide long term permissions to perform decryption.
|
|
|
|
"""
|
|
if not isinstance(ciphertext_blob, six.binary_type):
|
|
raise TypeError(
|
|
"Value of argument ``ciphertext_blob`` "
|
|
"must be of type %s." % six.binary_type)
|
|
ciphertext_blob = base64.b64encode(ciphertext_blob)
|
|
params = {'CiphertextBlob': ciphertext_blob.decode('utf-8'), }
|
|
if encryption_context is not None:
|
|
params['EncryptionContext'] = encryption_context
|
|
if grant_tokens is not None:
|
|
params['GrantTokens'] = grant_tokens
|
|
response = self.make_request(action='Decrypt',
|
|
body=json.dumps(params))
|
|
if response.get('Plaintext') is not None:
|
|
response['Plaintext'] = base64.b64decode(
|
|
response['Plaintext'].encode('utf-8'))
|
|
return response
|
|
|
|
def delete_alias(self, alias_name):
|
|
"""
|
|
Deletes the specified alias.
|
|
|
|
:type alias_name: string
|
|
:param alias_name: The alias to be deleted.
|
|
|
|
"""
|
|
params = {'AliasName': alias_name, }
|
|
return self.make_request(action='DeleteAlias',
|
|
body=json.dumps(params))
|
|
|
|
def describe_key(self, key_id):
|
|
"""
|
|
Provides detailed information about the specified customer
|
|
master key.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the customer master key to be
|
|
described. This can be an ARN, an alias, or a globally unique
|
|
identifier.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
return self.make_request(action='DescribeKey',
|
|
body=json.dumps(params))
|
|
|
|
def disable_key(self, key_id):
|
|
"""
|
|
Marks a key as disabled, thereby preventing its use.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the customer master key to be
|
|
disabled. This can be an ARN, an alias, or a globally unique
|
|
identifier.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
return self.make_request(action='DisableKey',
|
|
body=json.dumps(params))
|
|
|
|
def disable_key_rotation(self, key_id):
|
|
"""
|
|
Disables rotation of the specified key.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the customer master key for which
|
|
rotation is to be disabled. This can be an ARN, an alias, or a
|
|
globally unique identifier.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
return self.make_request(action='DisableKeyRotation',
|
|
body=json.dumps(params))
|
|
|
|
def enable_key(self, key_id):
|
|
"""
|
|
Marks a key as enabled, thereby permitting its use. You can
|
|
have up to 25 enabled keys at one time.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the customer master key to be
|
|
enabled. This can be an ARN, an alias, or a globally unique
|
|
identifier.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
return self.make_request(action='EnableKey',
|
|
body=json.dumps(params))
|
|
|
|
def enable_key_rotation(self, key_id):
|
|
"""
|
|
Enables rotation of the specified customer master key.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the customer master key for which
|
|
rotation is to be enabled. This can be an ARN, an alias, or a
|
|
globally unique identifier.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
return self.make_request(action='EnableKeyRotation',
|
|
body=json.dumps(params))
|
|
|
|
def encrypt(self, key_id, plaintext, encryption_context=None,
|
|
grant_tokens=None):
|
|
"""
|
|
Encrypts plaintext into ciphertext by using a customer master
|
|
key.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the customer master. This can be an
|
|
ARN, an alias, or the Key ID.
|
|
|
|
:type plaintext: blob
|
|
:param plaintext: Data to be encrypted.
|
|
|
|
:type encryption_context: map
|
|
:param encryption_context: Name:value pair that specifies the
|
|
encryption context to be used for authenticated encryption. For
|
|
more information, see `Authenticated Encryption`_.
|
|
|
|
:type grant_tokens: list
|
|
:param grant_tokens: A list of grant tokens that represent grants which
|
|
can be used to provide long term permissions to perform encryption.
|
|
|
|
"""
|
|
if not isinstance(plaintext, six.binary_type):
|
|
raise TypeError(
|
|
"Value of argument ``plaintext`` "
|
|
"must be of type %s." % six.binary_type)
|
|
plaintext = base64.b64encode(plaintext)
|
|
params = {'KeyId': key_id, 'Plaintext': plaintext.decode('utf-8'), }
|
|
if encryption_context is not None:
|
|
params['EncryptionContext'] = encryption_context
|
|
if grant_tokens is not None:
|
|
params['GrantTokens'] = grant_tokens
|
|
response = self.make_request(action='Encrypt',
|
|
body=json.dumps(params))
|
|
if response.get('CiphertextBlob') is not None:
|
|
response['CiphertextBlob'] = base64.b64decode(
|
|
response['CiphertextBlob'].encode('utf-8'))
|
|
return response
|
|
|
|
def generate_data_key(self, key_id, encryption_context=None,
|
|
number_of_bytes=None, key_spec=None,
|
|
grant_tokens=None):
|
|
"""
|
|
Generates a secure data key. Data keys are used to encrypt and
|
|
decrypt data. They are wrapped by customer master keys.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the key. This can be an ARN, an
|
|
alias, or a globally unique identifier.
|
|
|
|
:type encryption_context: map
|
|
:param encryption_context: Name/value pair that contains additional
|
|
data to be authenticated during the encryption and decryption
|
|
processes that use the key. This value is logged by AWS CloudTrail
|
|
to provide context around the data encrypted by the key.
|
|
|
|
:type number_of_bytes: integer
|
|
:param number_of_bytes: Integer that contains the number of bytes to
|
|
generate. Common values are 128, 256, 512, 1024 and so on. 1024 is
|
|
the current limit.
|
|
|
|
:type key_spec: string
|
|
:param key_spec: Value that identifies the encryption algorithm and key
|
|
size to generate a data key for. Currently this can be AES_128 or
|
|
AES_256.
|
|
|
|
:type grant_tokens: list
|
|
:param grant_tokens: A list of grant tokens that represent grants which
|
|
can be used to provide long term permissions to generate a key.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
if encryption_context is not None:
|
|
params['EncryptionContext'] = encryption_context
|
|
if number_of_bytes is not None:
|
|
params['NumberOfBytes'] = number_of_bytes
|
|
if key_spec is not None:
|
|
params['KeySpec'] = key_spec
|
|
if grant_tokens is not None:
|
|
params['GrantTokens'] = grant_tokens
|
|
response = self.make_request(action='GenerateDataKey',
|
|
body=json.dumps(params))
|
|
if response.get('CiphertextBlob') is not None:
|
|
response['CiphertextBlob'] = base64.b64decode(
|
|
response['CiphertextBlob'].encode('utf-8'))
|
|
if response.get('Plaintext') is not None:
|
|
response['Plaintext'] = base64.b64decode(
|
|
response['Plaintext'].encode('utf-8'))
|
|
return response
|
|
|
|
def generate_data_key_without_plaintext(self, key_id,
|
|
encryption_context=None,
|
|
key_spec=None,
|
|
number_of_bytes=None,
|
|
grant_tokens=None):
|
|
"""
|
|
Returns a key wrapped by a customer master key without the
|
|
plaintext copy of that key. To retrieve the plaintext, see
|
|
GenerateDataKey.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the key. This can be an ARN, an
|
|
alias, or a globally unique identifier.
|
|
|
|
:type encryption_context: map
|
|
:param encryption_context: Name:value pair that contains additional
|
|
data to be authenticated during the encryption and decryption
|
|
processes.
|
|
|
|
:type key_spec: string
|
|
:param key_spec: Value that identifies the encryption algorithm and key
|
|
size. Currently this can be AES_128 or AES_256.
|
|
|
|
:type number_of_bytes: integer
|
|
:param number_of_bytes: Integer that contains the number of bytes to
|
|
generate. Common values are 128, 256, 512, 1024 and so on.
|
|
|
|
:type grant_tokens: list
|
|
:param grant_tokens: A list of grant tokens that represent grants which
|
|
can be used to provide long term permissions to generate a key.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
if encryption_context is not None:
|
|
params['EncryptionContext'] = encryption_context
|
|
if key_spec is not None:
|
|
params['KeySpec'] = key_spec
|
|
if number_of_bytes is not None:
|
|
params['NumberOfBytes'] = number_of_bytes
|
|
if grant_tokens is not None:
|
|
params['GrantTokens'] = grant_tokens
|
|
response = self.make_request(action='GenerateDataKeyWithoutPlaintext',
|
|
body=json.dumps(params))
|
|
if response.get('CiphertextBlob') is not None:
|
|
response['CiphertextBlob'] = base64.b64decode(
|
|
response['CiphertextBlob'].encode('utf-8'))
|
|
return response
|
|
|
|
def generate_random(self, number_of_bytes=None):
|
|
"""
|
|
Generates an unpredictable byte string.
|
|
|
|
:type number_of_bytes: integer
|
|
:param number_of_bytes: Integer that contains the number of bytes to
|
|
generate. Common values are 128, 256, 512, 1024 and so on. The
|
|
current limit is 1024 bytes.
|
|
|
|
"""
|
|
params = {}
|
|
if number_of_bytes is not None:
|
|
params['NumberOfBytes'] = number_of_bytes
|
|
response = self.make_request(action='GenerateRandom',
|
|
body=json.dumps(params))
|
|
if response.get('Plaintext') is not None:
|
|
response['Plaintext'] = base64.b64decode(
|
|
response['Plaintext'].encode('utf-8'))
|
|
return response
|
|
|
|
def get_key_policy(self, key_id, policy_name):
|
|
"""
|
|
Retrieves a policy attached to the specified key.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the key. This can be an ARN, an
|
|
alias, or a globally unique identifier.
|
|
|
|
:type policy_name: string
|
|
:param policy_name: String that contains the name of the policy.
|
|
Currently, this must be "default". Policy names can be discovered
|
|
by calling ListKeyPolicies.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, 'PolicyName': policy_name, }
|
|
return self.make_request(action='GetKeyPolicy',
|
|
body=json.dumps(params))
|
|
|
|
def get_key_rotation_status(self, key_id):
|
|
"""
|
|
Retrieves a Boolean value that indicates whether key rotation
|
|
is enabled for the specified key.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the key. This can be an ARN, an
|
|
alias, or a globally unique identifier.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
return self.make_request(action='GetKeyRotationStatus',
|
|
body=json.dumps(params))
|
|
|
|
def list_aliases(self, limit=None, marker=None):
|
|
"""
|
|
Lists all of the key aliases in the account.
|
|
|
|
:type limit: integer
|
|
:param limit: Specify this parameter when paginating results to
|
|
indicate the maximum number of aliases you want in each response.
|
|
If there are additional aliases beyond the maximum you specify, the
|
|
`Truncated` response element will be set to `true.`
|
|
|
|
:type marker: string
|
|
:param marker: Use this parameter when paginating results, and only in
|
|
a subsequent request after you've received a response where the
|
|
results are truncated. Set it to the value of the `NextMarker`
|
|
element in the response you just received.
|
|
|
|
"""
|
|
params = {}
|
|
if limit is not None:
|
|
params['Limit'] = limit
|
|
if marker is not None:
|
|
params['Marker'] = marker
|
|
return self.make_request(action='ListAliases',
|
|
body=json.dumps(params))
|
|
|
|
def list_grants(self, key_id, limit=None, marker=None):
|
|
"""
|
|
List the grants for a specified key.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the key. This can be an ARN, an
|
|
alias, or a globally unique identifier.
|
|
|
|
:type limit: integer
|
|
:param limit: Specify this parameter only when paginating results to
|
|
indicate the maximum number of grants you want listed in the
|
|
response. If there are additional grants beyond the maximum you
|
|
specify, the `Truncated` response element will be set to `true.`
|
|
|
|
:type marker: string
|
|
:param marker: Use this parameter only when paginating results, and
|
|
only in a subsequent request after you've received a response where
|
|
the results are truncated. Set it to the value of the `NextMarker`
|
|
in the response you just received.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
if limit is not None:
|
|
params['Limit'] = limit
|
|
if marker is not None:
|
|
params['Marker'] = marker
|
|
return self.make_request(action='ListGrants',
|
|
body=json.dumps(params))
|
|
|
|
def list_key_policies(self, key_id, limit=None, marker=None):
|
|
"""
|
|
Retrieves a list of policies attached to a key.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the key. This can be an ARN, an
|
|
alias, or a globally unique identifier.
|
|
|
|
:type limit: integer
|
|
:param limit: Specify this parameter only when paginating results to
|
|
indicate the maximum number of policies you want listed in the
|
|
response. If there are additional policies beyond the maximum you
|
|
specify, the `Truncated` response element will be set to `true.`
|
|
|
|
:type marker: string
|
|
:param marker: Use this parameter only when paginating results, and
|
|
only in a subsequent request after you've received a response where
|
|
the results are truncated. Set it to the value of the `NextMarker`
|
|
in the response you just received.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, }
|
|
if limit is not None:
|
|
params['Limit'] = limit
|
|
if marker is not None:
|
|
params['Marker'] = marker
|
|
return self.make_request(action='ListKeyPolicies',
|
|
body=json.dumps(params))
|
|
|
|
def list_keys(self, limit=None, marker=None):
|
|
"""
|
|
Lists the customer master keys.
|
|
|
|
:type limit: integer
|
|
:param limit: Specify this parameter only when paginating results to
|
|
indicate the maximum number of keys you want listed in the
|
|
response. If there are additional keys beyond the maximum you
|
|
specify, the `Truncated` response element will be set to `true.`
|
|
|
|
:type marker: string
|
|
:param marker: Use this parameter only when paginating results, and
|
|
only in a subsequent request after you've received a response where
|
|
the results are truncated. Set it to the value of the `NextMarker`
|
|
in the response you just received.
|
|
|
|
"""
|
|
params = {}
|
|
if limit is not None:
|
|
params['Limit'] = limit
|
|
if marker is not None:
|
|
params['Marker'] = marker
|
|
return self.make_request(action='ListKeys',
|
|
body=json.dumps(params))
|
|
|
|
def put_key_policy(self, key_id, policy_name, policy):
|
|
"""
|
|
Attaches a policy to the specified key.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the key. This can be an ARN, an
|
|
alias, or a globally unique identifier.
|
|
|
|
:type policy_name: string
|
|
:param policy_name: Name of the policy to be attached. Currently, the
|
|
only supported name is "default".
|
|
|
|
:type policy: string
|
|
:param policy: The policy, in JSON format, to be attached to the key.
|
|
|
|
"""
|
|
params = {
|
|
'KeyId': key_id,
|
|
'PolicyName': policy_name,
|
|
'Policy': policy,
|
|
}
|
|
return self.make_request(action='PutKeyPolicy',
|
|
body=json.dumps(params))
|
|
|
|
def re_encrypt(self, ciphertext_blob, destination_key_id,
|
|
source_encryption_context=None,
|
|
destination_encryption_context=None, grant_tokens=None):
|
|
"""
|
|
Encrypts data on the server side with a new customer master
|
|
key without exposing the plaintext of the data on the client
|
|
side. The data is first decrypted and then encrypted. This
|
|
operation can also be used to change the encryption context of
|
|
a ciphertext.
|
|
|
|
:type ciphertext_blob: blob
|
|
:param ciphertext_blob: Ciphertext of the data to re-encrypt.
|
|
|
|
:type source_encryption_context: map
|
|
:param source_encryption_context: Encryption context used to encrypt
|
|
and decrypt the data specified in the `CiphertextBlob` parameter.
|
|
|
|
:type destination_key_id: string
|
|
:param destination_key_id: Key identifier of the key used to re-encrypt
|
|
the data.
|
|
|
|
:type destination_encryption_context: map
|
|
:param destination_encryption_context: Encryption context to be used
|
|
when the data is re-encrypted.
|
|
|
|
:type grant_tokens: list
|
|
:param grant_tokens: Grant tokens that identify the grants that have
|
|
permissions for the encryption and decryption process.
|
|
|
|
"""
|
|
if not isinstance(ciphertext_blob, six.binary_type):
|
|
raise TypeError(
|
|
"Value of argument ``ciphertext_blob`` "
|
|
"must be of type %s." % six.binary_type)
|
|
ciphertext_blob = base64.b64encode(ciphertext_blob)
|
|
params = {
|
|
'CiphertextBlob': ciphertext_blob,
|
|
'DestinationKeyId': destination_key_id,
|
|
}
|
|
if source_encryption_context is not None:
|
|
params['SourceEncryptionContext'] = source_encryption_context
|
|
if destination_encryption_context is not None:
|
|
params['DestinationEncryptionContext'] = destination_encryption_context
|
|
if grant_tokens is not None:
|
|
params['GrantTokens'] = grant_tokens
|
|
response = self.make_request(action='ReEncrypt',
|
|
body=json.dumps(params))
|
|
if response.get('CiphertextBlob') is not None:
|
|
response['CiphertextBlob'] = base64.b64decode(
|
|
response['CiphertextBlob'].encode('utf-8'))
|
|
return response
|
|
|
|
def retire_grant(self, grant_token):
|
|
"""
|
|
Retires a grant. You can retire a grant when you're done using
|
|
it to clean up. You should revoke a grant when you intend to
|
|
actively deny operations that depend on it.
|
|
|
|
:type grant_token: string
|
|
:param grant_token: Token that identifies the grant to be retired.
|
|
|
|
"""
|
|
params = {'GrantToken': grant_token, }
|
|
return self.make_request(action='RetireGrant',
|
|
body=json.dumps(params))
|
|
|
|
def revoke_grant(self, key_id, grant_id):
|
|
"""
|
|
Revokes a grant. You can revoke a grant to actively deny
|
|
operations that depend on it.
|
|
|
|
:type key_id: string
|
|
:param key_id: Unique identifier of the key associated with the grant.
|
|
|
|
:type grant_id: string
|
|
:param grant_id: Identifier of the grant to be revoked.
|
|
|
|
"""
|
|
params = {'KeyId': key_id, 'GrantId': grant_id, }
|
|
return self.make_request(action='RevokeGrant',
|
|
body=json.dumps(params))
|
|
|
|
def update_key_description(self, key_id, description):
|
|
"""
|
|
|
|
|
|
:type key_id: string
|
|
:param key_id:
|
|
|
|
:type description: string
|
|
:param description:
|
|
|
|
"""
|
|
params = {'KeyId': key_id, 'Description': description, }
|
|
return self.make_request(action='UpdateKeyDescription',
|
|
body=json.dumps(params))
|
|
|
|
def make_request(self, action, body):
|
|
headers = {
|
|
'X-Amz-Target': '%s.%s' % (self.TargetPrefix, action),
|
|
'Host': self.region.endpoint,
|
|
'Content-Type': 'application/x-amz-json-1.1',
|
|
'Content-Length': str(len(body)),
|
|
}
|
|
http_request = self.build_base_http_request(
|
|
method='POST', path='/', auth_path='/', params={},
|
|
headers=headers, data=body)
|
|
response = self._mexe(http_request, sender=None,
|
|
override_num_retries=10)
|
|
response_body = response.read().decode('utf-8')
|
|
boto.log.debug(response_body)
|
|
if response.status == 200:
|
|
if response_body:
|
|
return json.loads(response_body)
|
|
else:
|
|
json_body = json.loads(response_body)
|
|
fault_name = json_body.get('__type', None)
|
|
exception_class = self._faults.get(fault_name, self.ResponseError)
|
|
raise exception_class(response.status, response.reason,
|
|
body=json_body)
|
|
|