chore: spec for S3EC Keyring/KmsKeyring #306
Conversation
| The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" | ||
| in this document are to be interpreted as described in [RFC2119](https://tools.ietf.org/html/rfc2119). | ||
|
|
||
| ## Interface |
There was a problem hiding this comment.
maybe too much for this review, but similarly to the mpl keyring interface,
https://github.com/awslabs/aws-encryption-sdk-specification/blob/master/framework/keyring-interface.md#interface
you may want to include more generic information on how the encrypt and decrypt operations should do
There was a problem hiding this comment.
I can add a short non-RFC 2119 sentence for each.
|
|
||
| ## Interface | ||
|
|
||
| The KmsKeyring MUST implement the [Keyring interface](keyring-interface.md#interface) and include the behavior described in the [S3 Keyring](s3-keyring.md). |
There was a problem hiding this comment.
i think you mean,
| The KmsKeyring MUST implement the [Keyring interface](keyring-interface.md#interface) and include the behavior described in the [S3 Keyring](s3-keyring.md). | |
| The KmsKeyring MUST implement the [Keyring interface](keyrings.md#interface) and include the behavior described in the [S3 Keyring](s3-keyring.md). |
?
| The KmsKeyring MAY validate that the AWS KMS key identifier is not null or empty. | ||
| If the KmsKeyring validates that the AWS KMS key identifier is not null or empty, then it MUST throw an exception. | ||
| The KmsKeyring MAY validate that the AWS KMS key identifier is [a valid AWS KMS Key identifier](../../framework/aws-kms/aws-kms-key-arn.md#a-valid-aws-kms-identifier). | ||
| If the KmsKeyring validates that the AWS KMS key identifier is not a valid AWS KMS Key identifier, then it MUST throw an exception. |
There was a problem hiding this comment.
nit: perhaps a good start to specify the type of exception that gets thrown or at least the error message?
There was a problem hiding this comment.
Ideally but since the S3EC V3 Java doesn't actually do these validations, it's currently unspecified.
Issue #, if available:
Description of changes:
Spec for S3EC Keyring/S3 Keyring/KmsKeyring.
Java annotations: aws/amazon-s3-encryption-client-java#483
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Check any applicable: