AWS KMS 階層キーリング

// Define a branch key ID supplier that uses the encryption context to
// select a branch key ID for each tenant.
public class ExampleBranchKeyIdSupplier implements IBranchKeyIdSupplier {
    private static String branchKeyIdForTenantA;
    private static String branchKeyIdForTenantB;

    public ExampleBranchKeyIdSupplier(String tenant1Id, String tenant2Id) {
        this.branchKeyIdForTenantA = tenant1Id;
        this.branchKeyIdForTenantB = tenant2Id;
    }

    @Override
    public GetBranchKeyIdOutput GetBranchKeyId(GetBranchKeyIdInput input) {
        Map<String, String> encryptionContext = input.encryptionContext();
        if (!encryptionContext.containsKey("tenant")) {
            throw new IllegalArgumentException(
                "EncryptionContext invalid, does not contain expected tenant key value pair.");
        }

        String tenantKeyId = encryptionContext.get("tenant");
        String branchKeyId;
        if (tenantKeyId.equals("TenantA")) {
            branchKeyId = branchKeyIdForTenantA;
        } else if (tenantKeyId.equals("TenantB")) {
            branchKeyId = branchKeyIdForTenantB;
        } else {
            throw new IllegalArgumentException("Item does not contain valid tenant ID");
        }

        return GetBranchKeyIdOutput.builder().branchKeyId(branchKeyId).build();
    }
}

// Create the branch key ID supplier
final IBranchKeyIdSupplier branchKeyIdSupplier = new ExampleBranchKeyIdSupplier(
    branch-key-ID-tenantA, branch-key-ID-tenantB);

// Define a branch key ID supplier that uses the encryption context to
// select a branch key ID for each tenant.
public class ExampleBranchKeySupplier : BranchKeyIdSupplierBase {
    private string branchKeyTenantA;
    private string branchKeyTenantB;

    public ExampleBranchKeySupplier(string branchKeyTenantA, string branchKeyTenantB) {
        this.branchKeyTenantA = branchKeyTenantA;
        this.branchKeyTenantB = branchKeyTenantB;
    }

    // The encryption context is used to determine the Branch Key ID.
    protected override GetBranchKeyIdOutput _GetBranchKeyId(GetBranchKeyIdInput input) {
        Dictionary<string, string> encryptionContext = input.EncryptionContext;
        if (!encryptionContext.ContainsKey("tenant")) {
            throw new Exception("EncryptionContext invalid, does not contain expected tenant key value pair.");
        }

        string tenant = encryptionContext["tenant"];
        if (tenant.Equals("TenantA")) {
            return new GetBranchKeyIdOutput { BranchKeyId = branchKeyTenantA };
        }
        if (tenant.Equals("TenantB")) {
            return new GetBranchKeyIdOutput { BranchKeyId = branchKeyTenantB };
        }
        throw new Exception("Item does not have a valid tenantID.");
    }
}

// Create the branch key ID supplier
var branchKeyIdSupplier = new ExampleBranchKeySupplier(
    branch-key-ID-tenantA, branch-key-ID-tenantB);

# Define a branch key ID supplier that uses the encryption context to
# select a branch key ID for each tenant.
class ExampleBranchKeyIdSupplier(IBranchKeyIdSupplier):
    branch_key_id_for_tenant_A: str
    branch_key_id_for_tenant_B: str

    def __init__(self, tenant_1_id, tenant_2_id):
        self.branch_key_id_for_tenant_A = tenant_1_id
        self.branch_key_id_for_tenant_B = tenant_2_id

    def get_branch_key_id(
        self, param: GetBranchKeyIdInput
    ) -> GetBranchKeyIdOutput:
        encryption_context = param.encryption_context
        if "tenant" not in encryption_context:
            raise ValueError("EncryptionContext invalid, does not contain expected tenant key value pair.")

        tenant_key_id = encryption_context.get("tenant")
        if tenant_key_id == "TenantA":
            branch_key_id = self.branch_key_id_for_tenant_A
        elif tenant_key_id == "TenantB":
            branch_key_id = self.branch_key_id_for_tenant_B
        else:
            raise ValueError(f"Item does not contain valid tenant ID: {tenant_key_id=}")

        return GetBranchKeyIdOutput(branch_key_id=branch_key_id)

# Create the branch key ID supplier
branch_key_id_supplier: IBranchKeyIdSupplier = ExampleBranchKeyIdSupplier(
        tenant_1_id=branch_key_id_a,
        tenant_2_id=branch_key_id_b,
)

// Define a branch key ID supplier that uses the encryption context to
// select a branch key ID for each tenant.
pub struct ExampleBranchKeyIdSupplier {
    branch_key_id_for_tenant_a: String,
    branch_key_id_for_tenant_b: String,
}

impl ExampleBranchKeyIdSupplier {
    pub fn new(tenant_a_id: &str, tenant_b_id: &str) -> Self {
        Self {
            branch_key_id_for_tenant_a: tenant_a_id.to_string(),
            branch_key_id_for_tenant_b: tenant_b_id.to_string(),
        }
    }
}

// The encryption context is used to determine the Branch Key ID.
impl BranchKeyIdSupplier for ExampleBranchKeyIdSupplier {
    fn get_branch_key_id(&self, input: GetBranchKeyIdInput) -> Result<GetBranchKeyIdOutput, Error> {
        let encryption_context: HashMap<String, String> = input.encryption_context.unwrap();
        if !encryption_context.contains_key("tenant") {
            return Err(Error::AwsCryptographicMaterialProvidersException {
                message: "EncryptionContext invalid, does not contain expected tenant key value pair.".to_string(),
            });
        }

        let tenant_key_id: &str = encryption_context["tenant"].as_str();
        if tenant_key_id == "TenantA" {
            Ok(GetBranchKeyIdOutput::builder()
                .branch_key_id(self.branch_key_id_for_tenant_a.clone())
                .build()
                .unwrap())
        } else if tenant_key_id == "TenantB" {
            Ok(GetBranchKeyIdOutput::builder()
                .branch_key_id(self.branch_key_id_for_tenant_b.clone())
                .build()
                .unwrap())
        } else {
            Err(Error::AwsCryptographicMaterialProvidersException {
                message: "Item does not contain valid tenant ID.".to_string(),
            })
        }
    }
}

// Create the branch key ID supplier
let branch_key_id_supplier = ExampleBranchKeyIdSupplier::new(
    &branch_key_id_a,
    &branch_key_id_b,
);

// Define a branch key ID supplier that uses the encryption context to
// select a branch key ID for each tenant.
type branchKeySupplier struct {
    branchKeyA string
    branchKeyB string
}

// The encryption context is used to determine the Branch Key ID.
func (b *branchKeySupplier) GetBranchKeyId(input mpltypes.GetBranchKeyIdInput) (*mpltypes.GetBranchKeyIdOutput, error) {
    ec := input.EncryptionContext
    if value, exists := ec["tenant"]; !exists || value == "" {
        return nil, fmt.Errorf("EncryptionContext invalid, does not contain expected tenant key value pair.")
    }

    branchKeyIdentifier := ec["tenant"]
    if branchKeyIdentifier == "TenantA" {
        return &mpltypes.GetBranchKeyIdOutput{BranchKeyId: b.branchKeyA}, nil
    } else if branchKeyIdentifier == "TenantB" {
        return &mpltypes.GetBranchKeyIdOutput{BranchKeyId: b.branchKeyB}, nil
    } else {
        return &mpltypes.GetBranchKeyIdOutput{}, fmt.Errorf("unknown branch key identifier")
    }
}

// Create the branch key ID supplier
keySupplier := branchKeySupplier{branchKeyA: branchKeyA, branchKeyB: branchKeyB}

final MaterialProviders matProv = MaterialProviders.builder()
        .MaterialProvidersConfig(MaterialProvidersConfig.builder().build())
        .build();
final CreateAwsKmsHierarchicalKeyringInput keyringInput = CreateAwsKmsHierarchicalKeyringInput.builder()
        .keyStore(keystore)
        .branchKeyIdSupplier(branchKeyIdSupplier)
        .ttlSeconds(600)
        .cache(CacheType.builder() //OPTIONAL
                .Default(DefaultCache.builder()
                .entryCapacity(100)
                .build())
        .build();
final Keyring hierarchicalKeyring = matProv.CreateAwsKmsHierarchicalKeyring(keyringInput);

var matProv = new MaterialProviders(new MaterialProvidersConfig());
var keyringInput = new CreateAwsKmsHierarchicalKeyringInput
{
   KeyStore = keystore,
   BranchKeyIdSupplier = branchKeyIdSupplier,
   TtlSeconds = 600, 
   Cache = new CacheType
   {
        Default = new DefaultCache { EntryCapacity = 100 }
   }
};
var hierarchicalKeyring = matProv.CreateAwsKmsHierarchicalKeyring(keyringInput);

mat_prov: AwsCryptographicMaterialProviders = AwsCryptographicMaterialProviders(
    config=MaterialProvidersConfig()
)

keyring_input: CreateAwsKmsHierarchicalKeyringInput = CreateAwsKmsHierarchicalKeyringInput(
    key_store=keystore,
    branch_key_id_supplier=branch_key_id_supplier,
    ttl_seconds=600,
    cache=CacheTypeDefault(
        value=DefaultCache(
            entry_capacity=100
        )
    ),
)

hierarchical_keyring: IKeyring = mat_prov.create_aws_kms_hierarchical_keyring(
    input=keyring_input
)

let mpl_config = MaterialProvidersConfig::builder().build()?;
let mpl = mpl_client::Client::from_conf(mpl_config)?;

let hierarchical_keyring = mpl
    .create_aws_kms_hierarchical_keyring()
    .key_store(key_store.clone())
    .branch_key_id_supplier(branch_key_id_supplier)
    .ttl_seconds(600)
    .send()
    .await?;

hkeyringInput := mpltypes.CreateAwsKmsHierarchicalKeyringInput{
    KeyStore:            keyStore,
    BranchKeyIdSupplier: &keySupplier,
    TtlSeconds:          600,
}
hKeyRing, err := matProv.CreateAwsKmsHierarchicalKeyring(context.Background(), hkeyringInput)
if err != nil {
    panic(err)
}