Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

KMS: Fix method for specifying custom key material #1482

Merged
merged 2 commits into from
Sep 23, 2024
Merged

KMS: Fix method for specifying custom key material #1482

merged 2 commits into from
Sep 23, 2024

Conversation

ainoya
Copy link
Contributor

@ainoya ainoya commented Sep 14, 2024

In the previous documentation, it was possible to create a key, but when running kms encrypt, the error Invalid key size (136) for AES. would occur. I've updated the documentation to ensure that the key is generated with a size of 32 bytes.

Example:

$ echo 'c3VwZXIgc2VjcmV0IGtleQo=' | base64 -d
super secret key
$ awslocal kms create-key --tags '[{"TagKey":"_custom_key_material_","TagValue":"c3VwZXIgc2VjcmV0IGtleQo="}]'
{
    "KeyMetadata": {
        "AWSAccountId": "000000000000",
        "KeyId": "74a102af-5a49-40bb-bac6-530e7c0cb9cd",
        "Arn": "arn:aws:kms:ap-northeast-1:000000000000:key/74a102af-5a49-40bb-bac6-530e7c0cb9cd",
        "CreationDate": "2024-09-14T14:37:48.238508+09:00",
        "Enabled": true,
        "Description": "",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "Enabled",
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
        "KeySpec": "SYMMETRIC_DEFAULT",
        "EncryptionAlgorithms": [
            "SYMMETRIC_DEFAULT"
        ],
        "MultiRegion": false
    }
}

$ awslocal kms encrypt --key-id 74a102af-5a49-40bb-bac6-530e7c0cb9cd --plaintext supersecret --output text --query CiphertextBlob --cli-binary-format raw-in-base64-out 

An error occurred (InternalError) when calling the Encrypt operation (reached max retries: 2): exception while calling kms.Encrypt: Invalid key size (136) for AES.

@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 14, 2024 •
edited
Loading

⚡️ Deploying PR Preview...

sannya-singal
sannya-singal requested changes Sep 19, 2024
View reviewed changes
Copy link
Contributor

@sannya-singal sannya-singal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for pointing this out 🙌 🚀 I have requested some changes regarding the custom key material we use to create a key, once thats fixed we can merge the PR.

content/en/user-guide/aws/kms/index.md Outdated
super secret key
</disable-copy>
$ awslocal kms create-key --tags '[{"TagKey":"_custom_key_material_","TagValue":"c3VwZXIgc2VjcmV0IGtleQo="}]'
$ CUSTOM_KEY_MATERIAL=$(openssl rand -base64 32)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would rather keep the format intact and change the string to thisisasecurekey which would give me dGhpc2lzYXNlY3VyZWtleQ==.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sannya-singal Apologies for the delayed response. I've made the correction as you suggested.

sannya-singal
sannya-singal reviewed Sep 20, 2024
View reviewed changes
Copy link
Contributor

@sannya-singal sannya-singal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @ainoya, let me know if something is not clear or you need help, happy to assist :)

sannya-singal
sannya-singal approved these changes Sep 23, 2024
View reviewed changes
Copy link
Contributor

@sannya-singal sannya-singal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for fixing the reviews, changes LGTM 🎉

@sannya-singal sannya-singal merged commit 2622fb8 into localstack:main Sep 23, 2024
4 checks passed
@ainoya ainoya deleted the patch-1 branch September 23, 2024 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sannya-singal sannya-singal sannya-singal approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ainoya @sannya-singal