def test_dynamodb_create_table_with_sse_specification(self):
dynamodb = aws_stack.connect_to_service("dynamodb")
table_name = "ddb-table-%s" % short_uid()
kms_master_key_id = long_uid()
sse_specification = {
"Enabled": True,
"SSEType": "KMS",
"KMSMasterKeyId": kms_master_key_id
}
kms_master_key_arn = aws_stack.kms_key_arn(kms_master_key_id)
result = dynamodb.create_table(
TableName=table_name,
KeySchema=[{
"AttributeName": "id",
"KeyType": "HASH"
}],
AttributeDefinitions=[{
"AttributeName": "id",
"AttributeType": "S"
}],
ProvisionedThroughput={
"ReadCapacityUnits": 5,
"WriteCapacityUnits": 5
},
SSESpecification=sse_specification,
Tags=TEST_DDB_TAGS,
)
self.assertTrue(result["TableDescription"]["SSEDescription"])
self.assertEqual(
"ENABLED", result["TableDescription"]["SSEDescription"]["Status"])
self.assertEqual(
kms_master_key_arn,
result["TableDescription"]["SSEDescription"]["KMSMasterKeyArn"],
)
delete_table(table_name)
def _generate_data_key_pair(data, create_cipher=True, add_to_keys=True):
region_details = KMSBackend.get()
kms = aws_stack.connect_to_service("kms")
key_id = data.get("KeyId")
key_spec = data.get("KeyPairSpec") or data.get("KeySpec") or data.get(
"CustomerMasterKeySpec")
key = None
public_format = None
if key_spec.startswith("RSA"):
rsa_key_sizes = {
"RSA_2048": 2048,
"RSA_3072": 3072,
"RSA_4096": 4096,
}
key_size = rsa_key_sizes.get(key_spec)
key = rsa.generate_private_key(public_exponent=65537,
key_size=key_size)
public_format = crypto_serialization.PublicFormat.PKCS1
if key_spec.startswith("ECC"):
curve = None
if key_spec == "ECC_NIST_P256":
curve = ec.SECP256R1()
elif key_spec == "ECC_NIST_P384":
curve = ec.SECP384R1()
elif key_spec == "ECC_NIST_P521":
curve = ec.SECP521R1()
elif key_spec == "ECC_SECG_P256K1":
curve = ec.SECP256K1()
key = ec.generate_private_key(curve)
public_format = crypto_serialization.PublicFormat.SubjectPublicKeyInfo
private_key = key.private_bytes(
crypto_serialization.Encoding.DER,
crypto_serialization.PrivateFormat.PKCS8,
crypto_serialization.NoEncryption(),
)
public_key = key.public_key().public_bytes(
crypto_serialization.Encoding.DER, public_format)
cipher_text = None
if create_cipher:
cipher_text = kms.encrypt(KeyId=key_id,
Plaintext=private_key)["CiphertextBlob"]
region = region_details.get_current_request_region()
result = {
"PrivateKeyCiphertextBlob": cipher_text,
"PrivateKeyPlaintext": private_key,
"PublicKey": public_key,
"KeyId": key_id,
"KeyPairSpec": key_spec,
"KeySpec": key_spec,
"KeyUsage": "SIGN_VERIFY",
"Policy": data.get("Policy"),
"Region": region,
"Description": data.get("Description"),
"Arn": key_id and aws_stack.kms_key_arn(key_id),
"_key_": key,
}
if add_to_keys:
region_details.key_pairs[key_id] = result
key = Key("", result["KeyUsage"], key_spec, result["Description"], region)
key.id = key_id
result = {**key.to_dict()["KeyMetadata"], **result}
result.pop("Region")
if add_to_keys:
result.pop("_key_")
return result
def get_physical_resource_id(self, attribute=None, **kwargs):
if attribute in REF_ID_ATTRS:
return self.physical_resource_id
return self.physical_resource_id and aws_stack.kms_key_arn(self.physical_resource_id)