Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
async def test_kms_crypto_context_decrypt_no_key(event_loop, s3_moto_patch, kms_moto_patch, region, bucket_name, kms_key_alias):
# Create context
kms_context = cse.KMSCryptoContext(kms_client_args={'region_name': region})
await kms_context.setup()
with pytest.raises(ValueError):
# Cant get KMS encryption key without key id specified
await kms_context.get_encryption_aes_key()
await kms_context.close()
async def get_encryption_aes_key(self) -> Tuple[bytes, Dict[str, str], str]:
if self.kms_key is None:
raise ValueError('KMS Key not provided during initalisation, cannot decrypt key encrypting key')
encryption_context = {'kms_cmk_id': self.kms_key}
kms_resp = await self._kms_client.generate_data_key(
KeyId=self.kms_key,
EncryptionContext=encryption_context,
KeySpec='AES_256'
)
return kms_resp['Plaintext'], encryption_context, base64.b64encode(kms_resp['CiphertextBlob']).decode()
class MockKMSCryptoContext(KMSCryptoContext):
def __init__(self, aes_key: bytes, material_description: dict, encrypted_key: bytes,
authenticated_encryption: bool = True):
super(MockKMSCryptoContext, self).__init__()
self.aes_key = aes_key
self.material_description = material_description
self.encrypted_key = encrypted_key
self.authenticated_encryption = authenticated_encryption
async def setup(self):
pass
async def close(self):
pass
async def get_decryption_aes_key(self, key: bytes, material_description: Dict[str, Any]) -> bytes:
return self.aes_key
:param: Body: File data
:param Bucket: S3 Bucket
:param Key: S3 Key (filepath)
"""
if self._s3_client is None:
await self.setup()
if hasattr(Body, 'read'):
if inspect.iscoroutinefunction(Body.read):
Body = await Body.read()
else:
Body = Body.read()
# We do some different V2 stuff if using kms
is_kms = isinstance(self._crypto_context, KMSCryptoContext)
# noinspection PyUnresolvedReferences
authenticated_crypto = is_kms and self._crypto_context.authenticated_encryption
Metadata = Metadata if Metadata is not None else {}
aes_key, matdesc_metadata, key_metadata = await self._crypto_context.get_encryption_aes_key()
if is_kms and authenticated_crypto:
Metadata['x-amz-cek-alg'] = 'AES/GCM/NoPadding'
Metadata['x-amz-tag-len'] = str(AES_BLOCK_SIZE)
iv = os.urandom(12)
# 16byte 128bit authentication tag forced
aesgcm = AESGCM(aes_key)
result = await self._loop.run_in_executor(None, lambda: aesgcm.encrypt(iv, Body, None))