AWS KMS 钥匙圈

要 AWS KMS key 在中的加密密钥环中识别一个 AWS Encryption SDK for C，请指定密钥ARN或别名ARN。在解密密钥环中，必须使用密钥。ARN有关详细信息，请参阅在 AWS KMS 钥匙圈 AWS KMS keys 中识别。

有关完整的示例，请参阅 string.cpp。

const char * generator_key = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"

const char * additional_key = "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"    

struct aws_cryptosdk_keyring *kms_encrypt_keyring = 
       Aws::Cryptosdk::KmsKeyring::Builder().Build(generator_key,{additional_key});

在 for 中创建包含一个或多个 AWS KMS 密钥 AWS Encryption SDK 的密钥 AWS KMS 环。 NET，创建一个多密钥环。那个 AWS Encryption SDK for。 NET包括一个仅用于 AWS KMS 存放钥匙的多钥匙圈。

当您在 for 中 AWS KMS key 为加密密钥环指定时 AWS Encryption SDK 。 NET，您可以使用任何有效的密钥标识符：密钥 ID、密钥ARN、别名或别名ARN。有关识别 AWS KMS 钥匙圈 AWS KMS keys 中的的帮助，请参阅在 AWS KMS 钥匙圈 AWS KMS keys 中识别。

以下示例使用版本 4。 for AWS Encryption SDK 的 x。 NET创建带有生成器 AWS KMS 密钥和其他密钥的密钥环。有关完整示例，请参阅 AwsKmsMultiKeyringExample.cs。

// Instantiate the AWS Encryption SDK and material provider
var mpl = new MaterialProviders(new MaterialProvidersConfig());
var esdk =  new ESDK(new AwsEncryptionSdkConfig());

string generatorKey = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab";
List<string> additionalKey = new List<string> { "alias/exampleAlias" };

// Instantiate the keyring input object
var kmsEncryptKeyringInput = new CreateAwsKmsMultiKeyringInput
{
    Generator = generatorKey,
    KmsKeyIds = additionalKey
};

var kmsEncryptKeyring = materialProviders.CreateAwsKmsMultiKeyring(kmsEncryptKeyringInput);

在中 AWS KMS key 为加密密钥环指定时 AWS Encryption SDK for JavaScript，您可以使用任何有效的密钥标识符：密钥 ID、密钥ARN、别名或别名ARN。有关识别 AWS KMS 钥匙圈 AWS KMS keys 中的的帮助，请参阅在 AWS KMS 钥匙圈 AWS KMS keys 中识别。

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

有关完整的示例，请参阅中存储库中的 kms_simple.ts。 AWS Encryption SDK for JavaScript GitHub

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const clientProvider = getClient(KMS, { credentials })
const generatorKeyId = 'arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab'
const additionalKey = 'alias/exampleAlias'

const keyring = new KmsKeyringBrowser({
  clientProvider, 
  generatorKeyId, 
  keyIds: [additionalKey] 
})

在中 AWS KMS key 为加密密钥环指定时 AWS Encryption SDK for JavaScript，您可以使用任何有效的密钥标识符：密钥 ID、密钥ARN、别名或别名ARN。有关识别 AWS KMS 钥匙圈 AWS KMS keys 中的的帮助，请参阅在 AWS KMS 钥匙圈 AWS KMS keys 中识别。

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

有关完整的示例，请参阅中存储库中的 kms_simple.ts。 AWS Encryption SDK for JavaScript GitHub

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const generatorKeyId = 'arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab'
                            
const additionalKey = 'alias/exampleAlias'

const keyring = new KmsKeyringNode({
  generatorKeyId,
  keyIds: [additionalKey]
})

要在中创建包含一个或多个 AWS KMS 密钥的密钥 AWS KMS 环 AWS Encryption SDK for Java，请创建一个多密钥环。 AWS Encryption SDK for Java 包括一个仅用于 AWS KMS 存放钥匙的多钥匙圈。

在中 AWS KMS key 为加密密钥环指定时 AWS Encryption SDK for Java，您可以使用任何有效的密钥标识符：密钥 ID、密钥ARN、别名或别名ARN。有关识别 AWS KMS 钥匙圈 AWS KMS keys 中的的帮助，请参阅在 AWS KMS 钥匙圈 AWS KMS keys 中识别。

有关完整示例，请参阅中 AWS Encryption SDK for Java 存储库中的 BasicEncryptionKeyringExample GitHub.java。

 // Instantiate the AWS Encryption SDK and material providers
final AwsCrypto crypto = AwsCrypto.builder().build();
final MaterialProviders materialProviders = MaterialProviders.builder()
            .MaterialProvidersConfig(MaterialProvidersConfig.builder().build())
            .build();

String generatorKey = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab";
List<String> additionalKey = Collections.singletonList("alias/exampleAlias");

// Create the AWS KMS keyring
final CreateAwsKmsMultiKeyringInput keyringInput = CreateAwsKmsMultiKeyringInput.builder()
        .generator(generatorKey)
        .kmsKeyIds(additionalKey)
        .build();
final IKeyring kmsKeyring = matProv.CreateAwsKmsMultiKeyring(keyringInput);

要在中创建包含一个或多个 AWS KMS 密钥的密钥 AWS KMS 环 AWS Encryption SDK for Python，请创建一个多密钥环。 AWS Encryption SDK for Python 包括一个仅用于 AWS KMS 存放钥匙的多钥匙圈。有关示例，请参阅中 AWS Encryption SDK for Python 存储库中的 aws_kms_multi_keyring_example.py GitHub。

在中 AWS KMS key 为加密密钥环指定时 AWS Encryption SDK for Python，您可以使用任何有效的密钥标识符：密钥 ID、密钥ARN、别名或别名ARN。有关识别 AWS KMS 钥匙圈 AWS KMS keys 中的的帮助，请参阅在 AWS KMS 钥匙圈 AWS KMS keys 中识别。

以下示例使用默认承诺策略实例化 AWS Encryption SDK 客户端。REQUIRE_ENCRYPT_REQUIRE_DECRYPT有关完整示例，请参阅中 AWS Encryption SDK for Python 存储库中的 aws_kms_keyring_example.py GitHub。

# Instantiate the AWS Encryption SDK client
client = aws_encryption_sdk.EncryptionSDKClient(
    commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)
        
# Create a boto3 client for AWS KMS
kms_client = boto3.client('kms', region_name="us-west-2")
        
# Optional: Create an encryption context
encryption_context: Dict[str, str] = {
    "encryption": "context",
    "is not": "secret",
    "but adds": "useful metadata",
    "that can help you": "be confident that",
    "the data you are handling": "is what you think it is",
}

# Instantiate the material providers library
mat_prov: AwsCryptographicMaterialProviders = AwsCryptographicMaterialProviders(
    config=MaterialProvidersConfig()
)

# Create the AWS KMS keyring 
keyring_input: CreateAwsKmsKeyringInput = CreateAwsKmsKeyringInput(
    generator=arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab,
    kms_key_ids=additionalKey
)

kms_keyring: IKeyring = mat_prov.create_aws_kms_keyring(
    input=keyring_input
)

const char * additional_key = "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"    

struct aws_cryptosdk_keyring *kms_decrypt_keyring = 
       Aws::Cryptosdk::KmsKeyring::Builder().Build(additional_key);

由于此解密密钥环仅包含一个 AWS KMS 密钥，因此该示例使用该CreateAwsKmsKeyring()方法及其对象的实例。CreateAwsKmsKeyringInput要使用一把 AWS KMS 钥匙创建 AWS KMS 密钥环，可以使用单钥或多钥匙圈。有关详细信息，请参阅在 for 中加密数据 AWS Encryption SDK 。 NET。以下示例使用版本 4。 for AWS Encryption SDK 的 x。 NET创建用于解 AWS KMS 密的密钥环。

// Instantiate the AWS Encryption SDK and material providers
var esdk =  new ESDK(new AwsEncryptionSdkConfig());
var mpl = new MaterialProviders(new MaterialProvidersConfig());

string additionalKey = "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321";

// Instantiate a KMS keyring for one AWS KMS key.
var kmsDecryptKeyringInput = new CreateAwsKmsKeyringInput
{
    KmsClient = new AmazonKeyManagementServiceClient(),
    KmsKeyId = additionalKey
};

var kmsDecryptKeyring = materialProviders.CreateAwsKmsKeyring(kmsDecryptKeyringInput);

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const clientProvider = getClient(KMS, { credentials })
const additionalKey = 'arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321'

const keyring = new KmsKeyringBrowser({ clientProvider, keyIds: [additionalKey] })

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const additionalKey = 'arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321'

const keyring = new KmsKeyringNode({ keyIds: [additionalKey] })

由于此解密密钥环仅包含一个 AWS KMS 密钥，因此该示例使用该CreateAwsKmsKeyring()方法及其对象的实例。CreateAwsKmsKeyringInput要创建具有一把 AWS KMS 钥匙的 AWS KMS 密钥环，可以使用单钥或多钥匙圈。

// Instantiate the AWS Encryption SDK and material providers
final AwsCrypto crypto = AwsCrypto.builder().build();
final MaterialProviders materialProviders = MaterialProviders.builder()
        .MaterialProvidersConfig(MaterialProvidersConfig.builder().build())
        .build();
        
String additionalKey = "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321";

// Create a AwsKmsKeyring
CreateAwsKmsKeyringInput kmsDecryptKeyringInput = CreateAwsKmsKeyringInput.builder()
        .generator(additionalKey)
        .kmsClient(KmsClient.create())
        .build();
IKeyring kmsKeyring = materialProviders.CreateAwsKmsKeyring(kmsDecryptKeyringInput);

以下示例使用默认承诺策略实例化 AWS Encryption SDK 客户端。REQUIRE_ENCRYPT_REQUIRE_DECRYPT有关完整示例，请参阅中 AWS Encryption SDK for Python 存储库中的 aws_kms_keyring_example.py GitHub。

# Instantiate the AWS Encryption SDK client
client = aws_encryption_sdk.EncryptionSDKClient(
    commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)
        
# Create a boto3 client for AWS KMS
kms_client = boto3.client('kms', region_name="us-west-2")
        
# Instantiate the material providers   
mat_prov: AwsCryptographicMaterialProviders = AwsCryptographicMaterialProviders(
    config=MaterialProvidersConfig()
)

# Create the AWS KMS keyring
keyring_input: CreateAwsKmsKeyringInput = CreateAwsKmsKeyringInput(
    generator=additionalKey,
    kms_client=kms_client
)

kms_keyring: IKeyring = mat_prov.create_aws_kms_keyring(
    input=keyring_input
)

struct aws_cryptosdk_keyring *kms_decrypt_keyring = 
       Aws::Cryptosdk::KmsKeyring::Builder().Build(generator_key, {additional_key, other_key});

以下示例使用版本 4。 for AWS Encryption SDK 的 x。 NET。

// Instantiate the AWS Encryption SDK and material providers
var esdk =  new ESDK(new AwsEncryptionSdkConfig());
var mpl = new MaterialProviders(new MaterialProvidersConfig());

string generatorKey = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab";

// Instantiate a KMS keyring for one AWS KMS key.
var kmsDecryptKeyringInput = new CreateAwsKmsKeyringInput
{
    KmsClient = new AmazonKeyManagementServiceClient(),
    KmsKeyId = generatorKey
};

var kmsDecryptKeyring = materialProviders.CreateAwsKmsKeyring(kmsDecryptKeyringInput);

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const clientProvider = getClient(KMS, { credentials })

const keyring = new KmsKeyringBrowser({
  clientProvider, 
  generatorKeyId, 
  keyIds: [additionalKey, otherKey]
})

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const keyring = new KmsKeyringNode({
  generatorKeyId,
  keyIds: [additionalKey, otherKey]
})

// Instantiate the AWS Encryption SDK and material providers
final AwsCrypto crypto = AwsCrypto.builder().build();
final MaterialProviders materialProviders = MaterialProviders.builder()
        .MaterialProvidersConfig(MaterialProvidersConfig.builder().build())
        .build();
        
String generatorKey = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab";

// Create a AwsKmsKeyring
CreateAwsKmsKeyringInput kmsDecryptKeyringInput = CreateAwsKmsKeyringInput.builder()
        .generator(generatorKey)
        .kmsClient(KmsClient.create())
        .build();
IKeyring kmsKeyring = materialProviders.CreateAwsKmsKeyring(kmsDecryptKeyringInput);

以下示例使用默认承诺策略实例化 AWS Encryption SDK 客户端。REQUIRE_ENCRYPT_REQUIRE_DECRYPT有关完整示例，请参阅中 AWS Encryption SDK for Python 存储库中的 aws_kms_keyring_example.py GitHub。

# Instantiate the AWS Encryption SDK client
client = aws_encryption_sdk.EncryptionSDKClient(
    commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)
        
# Create a boto3 client for AWS KMS
kms_client = boto3.client('kms', region_name="us-west-2")
        
# Instantiate the material providers library  
mat_prov: AwsCryptographicMaterialProviders = AwsCryptographicMaterialProviders(
    config=MaterialProvidersConfig()
)

# Create the AWS KMS keyring
keyring_input: CreateAwsKmsKeyringInput = CreateAwsKmsKeyringInput(
    generator=arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab,
    kms_client=kms_client
)

kms_keyring: IKeyring = mat_prov.create_aws_kms_keyring(
    input=keyring_input
)

有关完整的示例，请参阅：kms_discovery.cpp。

std::shared_ptr<KmsKeyring::> discovery_filter(
    KmsKeyring::DiscoveryFilter::Builder("aws")
        .AddAccount("111122223333")
        .Build());

struct aws_cryptosdk_keyring *kms_discovery_keyring = Aws::Cryptosdk::KmsKeyring::Builder()
       .BuildDiscovery(discovery_filter));

以下示例使用版本 4。 for AWS Encryption SDK 的 x。 NET。

// Instantiate the AWS Encryption SDK and material providers
var esdk =  new ESDK(new AwsEncryptionSdkConfig());
var mpl = new MaterialProviders(new MaterialProvidersConfig());

List<string> account = new List<string> { "111122223333" };
        
// In a discovery keyring, you specify an AWS KMS client and a discovery filter,
// but not a AWS KMS key
var kmsDiscoveryKeyringInput = new CreateAwsKmsDiscoveryKeyringInput
{
    KmsClient = new AmazonKeyManagementServiceClient(),
    DiscoveryFilter = new DiscoveryFilter()
    {
        AccountIds = account,
        Partition = "aws"
    }
};
        
var kmsDiscoveryKeyring = materialProviders.CreateAwsKmsDiscoveryKeyring(kmsDiscoveryKeyringInput);

在中 JavaScript，必须明确指定发现属性。

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const clientProvider = getClient(KMS, { credentials })

const discovery = true
const keyring = new KmsKeyringBrowser(clientProvider, {
    discovery,
    discoveryFilter: { accountIDs: [111122223333], partition: 'aws' }
})

在中 JavaScript，必须明确指定发现属性。

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const discovery = true

const keyring = new KmsKeyringNode({
    discovery,
    discoveryFilter: { accountIDs: ['111122223333'], partition: 'aws' }
})

// Create discovery filter
DiscoveryFilter discoveryFilter = DiscoveryFilter.builder()
        .partition("aws")
        .accountIds(111122223333)
        .build();
// Create the discovery keyring
CreateAwsKmsMrkDiscoveryMultiKeyringInput createAwsKmsMrkDiscoveryMultiKeyringInput = CreateAwsKmsMrkDiscoveryMultiKeyringInput.builder()
        .discoveryFilter(discoveryFilter)
        .build();
IKeyring decryptKeyring = matProv.CreateAwsKmsMrkDiscoveryMultiKeyring(createAwsKmsMrkDiscoveryMultiKeyringInput);

# Instantiate the AWS Encryption SDK
client = aws_encryption_sdk.EncryptionSDKClient(
    commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

# Create a boto3 client for AWS KMS
kms_client = boto3.client('kms', region_name=aws_region)

# Optional: Create an encryption context
encryption_context: Dict[str, str] = {
    "encryption": "context",
    "is not": "secret",
    "but adds": "useful metadata",
    "that can help you": "be confident that",
    "the data you are handling": "is what you think it is",
}

# Instantiate the material providers
mat_prov: AwsCryptographicMaterialProviders = AwsCryptographicMaterialProviders(
    config=MaterialProvidersConfig()
)

# Create the AWS KMS discovery keyring
discovery_keyring_input: CreateAwsKmsDiscoveryKeyringInput = CreateAwsKmsDiscoveryKeyringInput(
    kms_client=kms_client,
    discovery_filter=DiscoveryFilter(
        account_ids=[aws_account_id],
        partition="aws"
    )
)

discovery_keyring: IKeyring = mat_prov.create_aws_kms_discovery_keyring(
    input=discovery_keyring_input
)
                            

要在可正常使用的示例中查看此密钥环和 create_kms_client 方法，请参阅 kms_discovery.cpp。

std::shared_ptr<KmsKeyring::DiscoveryFilter> discovery_filter(
    KmsKeyring::DiscoveryFilter::Builder("aws")
        .AddAccount("111122223333")
        .Build());

struct aws_cryptosdk_keyring *kms_regional_keyring = Aws::Cryptosdk::KmsKeyring::Builder()
       .WithKmsClient(create_kms_client(Aws::Region::US_WEST_2)).BuildDiscovery(discovery_filter));

那个 AWS Encryption SDK for。 NET没有专用的区域发现密钥环。但是，您可以使用多种技术来限制解密到特定区域时使用的密KMS钥。

限制发现密钥环中区域的最有效方法是使用发现密钥环，即使您仅使用单区域密钥对数据进行了加密。 multi-Region-aware当遇到单区域密钥时，密 multi-Region-aware钥环不使用任何多区域功能。

在调 AWS KMS用之前，该CreateAwsKmsMrkDiscoveryKeyring()方法返回的KMS密钥环会按区域过滤密钥。 AWS KMS 只有当加密的数据密钥由对象中的Region参数指定的区域中的密钥加密时，它才会向发送解KMS密请求。CreateAwsKmsMrkDiscoveryKeyringInput

以下示例使用版本 4。 for AWS Encryption SDK 的 x。 NET。

// Instantiate the AWS Encryption SDK and material providers
var esdk =  new ESDK(new AwsEncryptionSdkConfig());
var mpl = new MaterialProviders(new MaterialProvidersConfig());

List<string> account = new List<string> { "111122223333" };

// Create the discovery filter
var filter = DiscoveryFilter = new DiscoveryFilter
{
    AccountIds = account,
    Partition = "aws"
};
                                
var regionalDiscoveryKeyringInput = new CreateAwsKmsMrkDiscoveryKeyringInput
{
    KmsClient = new AmazonKeyManagementServiceClient(RegionEndpoint.USWest2),
    Region = RegionEndpoint.USWest2,
    DiscoveryFilter = filter
};                                

var kmsRegionalDiscoveryKeyring = materialProviders.CreateAwsKmsMrkDiscoveryKeyring(regionalDiscoveryKeyringInput);

您还可以 AWS 区域 通过在 AWS KMS 客户端实例中指定区域来将KMS密钥限制在特定的范围内 (AmazonKeyManagementServiceClient)。但是，与使用 multi-Region-aware发现密钥环相比，这种配置效率较低，而且成本可能更高。不是在调用之前按区域筛选KMS密钥 AWS KMS，而是 AWS Encryption SDK 使用 for。 NET调 AWS KMS 用每个加密的数据密钥（直到它解密一个密钥），并依赖 AWS KMS 于将其使用的KMS密钥限制在指定的区域。

以下示例使用版本 4。 for AWS Encryption SDK 的 x。 NET。

// Instantiate the AWS Encryption SDK and material providers
var esdk =  new ESDK(new AwsEncryptionSdkConfig());
var mpl = new MaterialProviders(new MaterialProvidersConfig());

List<string> account = new List<string> { "111122223333" };
        
// Create the discovery filter,
// but not a AWS KMS key
var createRegionalDiscoveryKeyringInput = new CreateAwsKmsDiscoveryKeyringInput
{
    KmsClient = new AmazonKeyManagementServiceClient(RegionEndpoint.USWest2),
    DiscoveryFilter = new DiscoveryFilter()
    {
        AccountIds = account,
        Partition = "aws"
    }
};
        
var kmsRegionalDiscoveryKeyring = materialProviders.CreateAwsKmsDiscoveryKeyring(createRegionalDiscoveryKeyringInput);

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const clientProvider = getClient(KMS, { credentials })

const discovery = true
const clientProvider = limitRegions(['us-west-2'], getKmsClient)
const keyring = new KmsKeyringBrowser(clientProvider, {
    discovery,
    discoveryFilter: { accountIDs: ['111122223333'], partition: 'aws' }
})

以下示例使用buildClient函数来指定默认的承诺策略REQUIRE_ENCRYPT_REQUIRE_DECRYPT。您也可以使用buildClient来限制加密消息中加密数据密钥的数量。有关更多信息，请参阅 限制加密数据密钥。

要在工作示例中查看此密钥环和limitRegions函数，请参阅 km s_regional_discovery.ts。

import {
  KmsKeyringNode,
  buildClient,
  CommitmentPolicy,
} from '@aws-crypto/client-node'

const { encrypt, decrypt } = buildClient(
  CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

const discovery = true
const clientProvider = limitRegions(['us-west-2'], getKmsClient)
const keyring = new KmsKeyringNode({
    clientProvider,
    discovery,
    discoveryFilter: { accountIDs: ['111122223333'], partition: 'aws' }
})

// Create the discovery filter
DiscoveryFilter discoveryFilter = DiscoveryFilter.builder()
        .partition("aws")
        .accountIds(111122223333)
        .build();
// Create the discovery keyring
CreateAwsKmsMrkDiscoveryMultiKeyringInput createAwsKmsMrkDiscoveryMultiKeyringInput = CreateAwsKmsMrkDiscoveryMultiKeyringInput.builder()
        .discoveryFilter(discoveryFilter)
        .regions("us-west-2")
        .build();
IKeyring decryptKeyring = matProv.CreateAwsKmsMrkDiscoveryMultiKeyring(createAwsKmsMrkDiscoveryMultiKeyringInput);

# Instantiate the AWS Encryption SDK
client = aws_encryption_sdk.EncryptionSDKClient(
    commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT
)

# Create a boto3 client for AWS KMS
kms_client = boto3.client('kms', region_name=aws_region)

# Optional: Create an encryption context
encryption_context: Dict[str, str] = {
    "encryption": "context",
    "is not": "secret",
    "but adds": "useful metadata",
    "that can help you": "be confident that",
    "the data you are handling": "is what you think it is",
}

# Instantiate the material providers
mat_prov: AwsCryptographicMaterialProviders = AwsCryptographicMaterialProviders(
    config=MaterialProvidersConfig()
)

# Create the AWS KMS regional discovery keyring
regional_discovery_keyring_input: CreateAwsKmsMrkDiscoveryKeyringInput = \
    CreateAwsKmsMrkDiscoveryKeyringInput(
        kms_client=kms_client,
        region=mrk_replica_decrypt_region,
        discovery_filter=DiscoveryFilter(
            account_ids=[111122223333],
            partition="aws"
        )
)

    regional_discovery_keyring: IKeyring = mat_prov.create_aws_kms_mrk_discovery_keyring(
        input=regional_discovery_keyring_input
    )