Skip to content

Commit aabbfed

Browse files
seebeesseebees
committed
small updates to arn things
1 parent 2383a74 commit aabbfed

File tree

3 files changed

+67
-40
lines changed

3 files changed

+67
-40
lines changed

‎modules/branch-keystore-node/src/kms_config.ts‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
// SPDX-License-Identifier: Apache-2.0
33

44
import {
5+
isMultiRegionAwsKmsArn,
56
// getRegionFromIdentifier,
67
parseAwsKmsKeyArn,
78
} from '@aws-crypto/kms-keyring'
@@ -78,13 +79,16 @@ export class KmsKeyConfig implements RegionalKmsConfig {
7879
//# that is a KMS ARN.
7980
constructor(config: KmsConfig) {
8081
readOnlyProperty(this, '_config', config)
82+
/* Precondition: config must be a string or object */
83+
const configType = typeof config
84+
needs(!!config && (configType === 'object' || 'string'), 'Config must be a `discovery` or an object.')
8185
if (config === 'discovery') {
8286
// Nothing to set
8387
} else if ('identifier' in config || 'mrkIdentifier' in config) {
8488
const arn =
8589
'identifier' in config ? config.identifier : config.mrkIdentifier
8690
/* Precondition: ARN must be a string */
87-
needs(arn || typeof arn === 'string', 'ARN must be a string')
91+
needs(typeof arn === 'string', 'ARN must be a string')
8892

8993
//= aws-encryption-sdk-specification/framework/branch-key-store.md#aws-kms-configuration
9094
//# To be clear, an KMS ARN for a Multi-Region Key MAY be provided to the `KMS Key ARN` configuration,
@@ -101,6 +105,7 @@ export class KmsKeyConfig implements RegionalKmsConfig {
101105
)
102106

103107
readOnlyProperty(this, '_parsedArn', parsedArn)
108+
readOnlyProperty(this, '_arn', arn)
104109
} else if ('region' in config) {
105110
readOnlyProperty(this, '_mrkRegion', config.region)
106111
} else {
@@ -170,7 +175,7 @@ export class KmsKeyConfig implements RegionalKmsConfig {
170175
//# For two ARNs to be compatible:
171176
//# If the [AWS KMS Configuration](#aws-kms-configuration) designates single region ARN compatibility,
172177
//# then two ARNs are compatible if they are exactly equal.
173-
return this._arn == otherArn
178+
return this._arn === otherArn
174179
} else if ('mrkIdentifier' in this._config) {
175180
//= aws-encryption-sdk-specification/framework/branch-key-store.md#aws-key-arn-compatibility
176181
//# If the [AWS KMS Configuration](#aws-kms-configuration) designates MRK ARN compatibility,
@@ -207,7 +212,7 @@ export class KmsKeyConfig implements RegionalKmsConfig {
207212
//# If the KMS Configuration is MRDiscovery, `KeyId` MUST be the `kms-arn` attribute value of the AWS DDB response item, with the region replaced by the configured region.
208213
const parsedArn = parseAwsKmsKeyArn(otherArn)
209214
needs(parsedArn, 'KMS ARN from the keystore is not an ARN:' + otherArn)
210-
return constructArnInOtherRegion(parsedArn, this._mrkRegion)
215+
return isMultiRegionAwsKmsArn(parsedArn) ? constructArnInOtherRegion(parsedArn, this._mrkRegion) : otherArn
211216
} else if (
212217
'identifier' in this._config ||
213218
'mrkIdentifier' in this._config

‎modules/branch-keystore-node/test/kms_config.test.ts‎

Lines changed: 58 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,7 @@
22
// SPDX-License-Identifier: Apache-2.0
33

44
import { expect } from 'chai'
5-
import {
6-
KmsKeyConfig,
7-
RegionalKmsConfig,
8-
KmsConfig,
9-
} from '../src/kms_config'
5+
import { KmsKeyConfig, RegionalKmsConfig, KmsConfig } from '../src/kms_config'
106

117
function supplySrkKmsConfig(config: KmsConfig): KmsKeyConfig {
128
return new KmsKeyConfig(config)
@@ -29,9 +25,20 @@ export const WELL_FORMED_MRK_ALIAS_ARN =
2925
'arn:aws:kms:us-west-2:123456789012:alias/mrk/my-mrk-alias'
3026

3127
describe('Test KmsKeyConfig class', () => {
28+
29+
it('Precondition: config must be a string or object', () => {
30+
for (const config of [null, undefined, 0]) {
31+
expect(() => supplySrkKmsConfig(config as any)).to.throw(
32+
'Config must be a `discovery` or an object.'
33+
)
34+
}
35+
})
3236
it('Precondition: ARN must be a string', () => {
3337
for (const arn of [null, undefined, 0, {}]) {
34-
expect(() => supplySrkKmsConfig(arn as any)).to.throw(
38+
expect(() => supplySrkKmsConfig({identifier: arn} as any)).to.throw(
39+
'ARN must be a string'
40+
)
41+
expect(() => supplySrkKmsConfig({mrkIdentifier: arn} as any)).to.throw(
3542
'ARN must be a string'
3643
)
3744
}
@@ -67,20 +74,20 @@ describe('Test KmsKeyConfig class', () => {
6774
})
6875

6976
describe('Test getCompatibleArnArn', () => {
70-
7177
it('Returns the SRK', () => {
72-
expect(config.getCompatibleArnArn(WELL_FORMED_SRK_ARN)).to.equal(WELL_FORMED_SRK_ARN)
78+
expect(config.getCompatibleArnArn(WELL_FORMED_SRK_ARN)).to.equal(
79+
WELL_FORMED_SRK_ARN
80+
)
7381
})
7482

7583
it('Throws for a non compatible value', () => {
7684
expect(() => config.getCompatibleArnArn(WELL_FORMED_MRK_ARN)).to.throw()
7785
})
78-
7986
})
8087
})
8188

8289
describe('Given a well formed MRK arn', () => {
83-
const config = supplySrkKmsConfig({ identifier: WELL_FORMED_MRK_ARN })
90+
const config = supplySrkKmsConfig({ mrkIdentifier: WELL_FORMED_MRK_ARN })
8491

8592
it('Test getRegion', () => {
8693
expect((config as RegionalKmsConfig).getRegion()).equals('us-west-2')
@@ -115,96 +122,110 @@ describe('Test KmsKeyConfig class', () => {
115122
})
116123

117124
describe('Test getCompatibleArnArn', () => {
118-
119125
it('Returns the MRK', () => {
120-
expect(config.getCompatibleArnArn(WELL_FORMED_MRK_ARN)).to.equal(WELL_FORMED_MRK_ARN)
126+
expect(config.getCompatibleArnArn(WELL_FORMED_MRK_ARN)).to.equal(
127+
WELL_FORMED_MRK_ARN
128+
)
121129
})
122130

123131
it('Returns the configured MRK because it is the right region', () => {
124-
expect(config.getCompatibleArnArn(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)).to.equal(WELL_FORMED_MRK_ARN)
132+
expect(
133+
config.getCompatibleArnArn(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)
134+
).to.equal(WELL_FORMED_MRK_ARN)
125135
})
126136

127137
it('Throws for a non compatible value', () => {
128138
expect(() => config.getCompatibleArnArn(WELL_FORMED_SRK_ARN)).to.throw()
129139
})
130-
131140
})
132141
})
133142

134143
describe('Given discovery configurations', () => {
135-
136144
it('Discovery is compatible with ARNs', () => {
137145
const config = supplySrkKmsConfig('discovery')
138-
expect(config.isCompatibleWithArn(ONE_PART_ARN)).to.equal(true)
139146
expect(config.isCompatibleWithArn(WELL_FORMED_SRK_ARN)).to.equal(true)
140147
expect(config.isCompatibleWithArn(WELL_FORMED_MRK_ARN)).to.equal(true)
141148
})
142149

143-
144150
it('MRDiscovery is compatible with ARNs', () => {
145-
const config = supplySrkKmsConfig({region: 'us-west-2'})
146-
expect(config.isCompatibleWithArn(ONE_PART_ARN)).to.equal(true)
151+
const config = supplySrkKmsConfig({ region: 'us-west-2' })
147152
expect(config.isCompatibleWithArn(WELL_FORMED_SRK_ARN)).to.equal(true)
148153
expect(config.isCompatibleWithArn(WELL_FORMED_MRK_ARN)).to.equal(true)
149154
})
150155

151156
it('Discovery MUST be an ARN', () => {
152157
const config = supplySrkKmsConfig('discovery')
153158
expect(() => config.isCompatibleWithArn(MALFORMED_ARN)).to.throw()
154-
expect(() => config.isCompatibleWithArn(WELL_FORMED_SRK_ALIAS_ARN)).to.throw()
155-
expect(() => config.isCompatibleWithArn(WELL_FORMED_MRK_ALIAS_ARN)).to.throw()
159+
expect(() =>
160+
config.isCompatibleWithArn(WELL_FORMED_SRK_ALIAS_ARN)
161+
).to.throw()
162+
expect(() =>
163+
config.isCompatibleWithArn(WELL_FORMED_MRK_ALIAS_ARN)
164+
).to.throw()
156165
})
157166

158-
159167
it('MRDiscovery MUST be an ARN', () => {
160-
const config = supplySrkKmsConfig({region: 'us-west-2'})
168+
const config = supplySrkKmsConfig({ region: 'us-west-2' })
161169
expect(() => config.isCompatibleWithArn(MALFORMED_ARN)).to.throw()
162-
expect(() => config.isCompatibleWithArn(WELL_FORMED_SRK_ALIAS_ARN)).to.throw()
163-
expect(() => config.isCompatibleWithArn(WELL_FORMED_MRK_ALIAS_ARN)).to.throw()
170+
expect(() =>
171+
config.isCompatibleWithArn(WELL_FORMED_SRK_ALIAS_ARN)
172+
).to.throw()
173+
expect(() =>
174+
config.isCompatibleWithArn(WELL_FORMED_MRK_ALIAS_ARN)
175+
).to.throw()
164176
})
165177

166178
describe('Test getCompatibleArnArn for discovery', () => {
167179
const config = supplySrkKmsConfig('discovery')
168180

169181
it('Returns the SRK', () => {
170-
expect(config.getCompatibleArnArn(WELL_FORMED_SRK_ARN)).to.equal(WELL_FORMED_SRK_ARN)
182+
expect(config.getCompatibleArnArn(WELL_FORMED_SRK_ARN)).to.equal(
183+
WELL_FORMED_SRK_ARN
184+
)
171185
})
172186

173187
it('Returns the MRK', () => {
174-
expect(config.getCompatibleArnArn(WELL_FORMED_MRK_ARN)).to.equal(WELL_FORMED_MRK_ARN)
188+
expect(config.getCompatibleArnArn(WELL_FORMED_MRK_ARN)).to.equal(
189+
WELL_FORMED_MRK_ARN
190+
)
175191
})
176192

177193
it('Returns the configured MRK because it is the right region', () => {
178-
expect(config.getCompatibleArnArn(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)).to.equal(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)
194+
expect(
195+
config.getCompatibleArnArn(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)
196+
).to.equal(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)
179197
})
180198

181199
it('Throws for a non compatible value', () => {
182-
expect(() => config.getCompatibleArnArn(WELL_FORMED_SRK_ARN)).to.throw()
200+
expect(() => config.getCompatibleArnArn(ONE_PART_ARN)).to.throw()
183201
})
184-
185202
})
186203

187204
describe('Test getCompatibleArnArn for MRDiscovery', () => {
188-
const config = supplySrkKmsConfig({region: 'us-east-1'})
205+
const config = supplySrkKmsConfig({ region: 'us-east-1' })
189206

190207
it('Returns the SRK', () => {
191-
expect(config.getCompatibleArnArn(WELL_FORMED_SRK_ARN)).to.equal(WELL_FORMED_SRK_ARN)
208+
expect(config.getCompatibleArnArn(WELL_FORMED_SRK_ARN)).to.equal(
209+
WELL_FORMED_SRK_ARN
210+
)
192211
})
193212

194213
it('Returns the MRK', () => {
195-
expect(config.getCompatibleArnArn(WELL_FORMED_MRK_ARN)).to.equal(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)
214+
expect(config.getCompatibleArnArn(WELL_FORMED_MRK_ARN)).to.equal(
215+
WELL_FORMED_MRK_ARN_DIFFERENT_REGION
216+
)
196217
})
197218

198219
it('Returns the configured MRK because it is the right region', () => {
199-
expect(config.getCompatibleArnArn(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)).to.equal(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)
220+
expect(
221+
config.getCompatibleArnArn(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)
222+
).to.equal(WELL_FORMED_MRK_ARN_DIFFERENT_REGION)
200223
})
201224

202225
it('Throws for a non compatible value', () => {
203-
expect(() => config.getCompatibleArnArn(WELL_FORMED_SRK_ARN)).to.throw()
226+
expect(() => config.getCompatibleArnArn(ONE_PART_ARN)).to.throw()
204227
})
205-
206228
})
207-
208229
})
209230

210231
//= aws-encryption-sdk-specification/framework/branch-key-store.md#aws-kms-configuration

‎modules/kms-keyring/src/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ export {
77
parseAwsKmsKeyArn,
88
constructArnInOtherRegion,
99
mrkAwareAwsKmsKeyIdCompare,
10+
isMultiRegionAwsKmsArn,
1011
ParsedAwsKmsKeyArn,
1112
} from './arn_parsing'
1213
export * from './kms_keyring'

0 commit comments

Comments
 (0)