def validate_config(self):
"""Validates the provided configuration."""
if not self.config.key_ids:
# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6
# //# The key id list MUST NOT be empty or null in strict mode.
raise ConfigMismatchError(
"To enable strict mode you must provide key ids")
for key_id in self.config.key_ids:
# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6
# //# The key id list MUST NOT contain any null or empty string values.
if not key_id:
raise ConfigMismatchError("Key ids must be valid AWS KMS ARNs")
if self.config.discovery_filter:
# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6
# //# A discovery filter MUST NOT be configured in strict mode.
raise ConfigMismatchError(
"To enable discovery mode, use a DiscoveryAwsKmsMasterKeyProvider"
)
if self.config.discovery_region:
# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6
# //# A default MRK Region MUST NOT be configured in strict mode.
raise ConfigMismatchError(
"To enable MRK-aware discovery mode, use a MRKAwareDiscoveryAwsKmsMasterKeyProvider"
)
def validate_config(self):
"""Validates the provided configuration."""
if not self.config.key_ids:
raise ConfigMismatchError(
"To enable strict mode you must provide key ids")
for key_id in self.config.key_ids:
if not key_id:
raise ConfigMismatchError("Key ids must be valid AWS KMS ARNs")
if self.config.discovery_filter:
raise ConfigMismatchError(
"To enable discovery mode, use a DiscoveryAwsKmsMasterKeyProvider"
)
def validate_config(self):
"""Validates the provided configuration."""
if self.config.key_ids:
raise ConfigMismatchError(
"To explicitly identify which keys should be used, use a "
"StrictAwsKmsMasterKeyProvider.")
if self.config.discovery_filter:
if not self.config.discovery_filter.account_ids or not self.config.discovery_filter.partition:
raise ConfigMismatchError(
"When specifying a discovery filter you must include both account ids and "
"partition")
for account in self.config.discovery_filter.account_ids:
if not account:
raise ConfigMismatchError(
"When specifying a discovery filter, account ids must be non-empty "
"strings")
def validate_config(self):
"""Validates the provided configuration."""
# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6
# //# In discovery mode
# //# if a default MRK Region is not configured the AWS SDK Default Region
# //# MUST be used.
if not self.config.discovery_region:
if not self.default_region:
# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6
# //# If an AWS SDK Default Region can not be obtained
# //# initialization MUST fail.
raise ConfigMismatchError(
"Failed to determine default discovery region; please provide an explicit discovery_region"
)
self.config.discovery_region = self.default_region
def validate_config(self):
"""Validates the provided configuration."""
if self.config.key_ids:
# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6
# //# The key id list MUST be empty in discovery mode.
raise ConfigMismatchError(
"To explicitly identify which keys should be used, use a "
"StrictAwsKmsMasterKeyProvider.")
if self.config.discovery_filter:
if not self.config.discovery_filter.account_ids or not self.config.discovery_filter.partition:
raise ConfigMismatchError(
"When specifying a discovery filter you must include both account ids and "
"partition")
for account in self.config.discovery_filter.account_ids:
if not account:
raise ConfigMismatchError(
"When specifying a discovery filter, account ids must be non-empty "
"strings")
if self.config.discovery_region:
raise ConfigMismatchError(
"To enable MRK-aware discovery mode, use a MRKAwareDiscoveryAwsKmsMasterKeyProvider."
)
def __new__(cls, **kwargs):
instance = super(MasterKey, cls).__new__(cls, **kwargs)
if instance.config.provider_id is not None:
# Only allow override if provider_id is NOT set to non-None for the class
if instance.provider_id is None:
instance.provider_id = instance.config.provider_id
elif instance.provider_id != instance.config.provider_id:
raise ConfigMismatchError(
'Config provider_id does not match MasterKey provider_id: {config} != {instance}'.format(
config=instance.config.provider_id,
instance=instance.provider_id
)
)
instance.key_id = instance.config.key_id
instance._key_index = {instance.key_id: instance}
instance._members = [instance]
return instance
def __new__(cls, **kwargs):
"""Performs universal prep work for all MasterKeys."""
instance = super(MasterKey, cls).__new__(cls, **kwargs)
if instance.config.provider_id is not None:
# Only allow override if provider_id is NOT set to non-None for the class
if instance.provider_id is None:
instance.provider_id = instance.config.provider_id
elif instance.provider_id != instance.config.provider_id:
raise ConfigMismatchError(
'Config provider_id does not match MasterKey provider_id: {config} != {instance}'
.format(config=instance.config.provider_id,
instance=instance.provider_id))
instance.key_id = instance.config.key_id
instance._encrypt_key_index = {instance.key_id: instance} # pylint: disable=protected-access
# We cannot make any general statements about key_info, so specifically enforce that decrypt index is empty.
instance._decrypt_key_index = {} # pylint: disable=protected-access
instance._members = [instance] # pylint: disable=protected-access
return instance
def validate_unique_mrks(self):
"""Make sure the set of configured key ids does not contain any related MRKs"""
# //= compliance/framework/aws-kms/aws-kms-mrk-aware-master-key-provider.txt#2.6
# //# All AWS KMS
# //# key identifiers are be passed to Assert AWS KMS MRK are unique (aws-
# //# kms-mrk-are-unique.md#Implementation) and the function MUST return
# //# success.
# //= compliance/framework/aws-kms/aws-kms-mrk-are-unique.txt#2.5
# //# The caller MUST provide:
# //= compliance/framework/aws-kms/aws-kms-mrk-are-unique.txt#2.5
# //# If the list does not contain any multi-Region keys (aws-kms-key-
# //# arn.md#identifying-an-aws-kms-multi-region-key) this function MUST
# //# exit successfully.
mrk_identifiers = filter(is_valid_mrk_identifier, self.config.key_ids)
duplicate_ids = set()
for key1, key2 in itertools.combinations(mrk_identifiers, 2):
if key1 in duplicate_ids and key2 in duplicate_ids:
pass
if _key_resource_match(key1, key2):
if key1 not in duplicate_ids:
duplicate_ids.add(key1)
if key2 not in duplicate_ids:
duplicate_ids.add(key2)
# //= compliance/framework/aws-kms/aws-kms-mrk-are-unique.txt#2.5
# //# If there are zero duplicate resource ids between the multi-region
# //# keys, this function MUST exit successfully
# //= compliance/framework/aws-kms/aws-kms-mrk-are-unique.txt#2.5
# //# If any duplicate multi-region resource ids exist, this function MUST
# //# yield an error that includes all identifiers with duplicate resource
# //# ids not only the first duplicate found.
if len(duplicate_ids) > 0:
raise ConfigMismatchError(
"Configured key ids must be unique. Found related MRKs: {keys}"
.format(keys=", ".join(duplicate_ids)))