Struct Client 

pub struct Client { /* private fields */ }

Implementations

impl Client

pub fn get_key_store_info(&self) -> GetKeyStoreInfoFluentBuilder

Constructs a fluent builder for the GetKeyStoreInfo operation.

• The fluent builder is configurable:
• On success, responds with GetKeyStoreInfoOutput with field(s):
  • grant_tokens(Option<::std::vec::Vec<::std::string::String>>): (undocumented)
  • key_store_id(Option<::std::string::String>): (undocumented)
  • key_store_name(Option<::std::string::String>): (undocumented)
  • kms_configuration(Option<crate::deps::aws_cryptography_keyStore::types::KmsConfiguration>): (undocumented)
  • logical_key_store_name(Option<::std::string::String>): (undocumented)
• On failure, responds with SdkError<GetKeyStoreInfoError>

impl Client

pub fn create_key_store(&self) -> CreateKeyStoreFluentBuilder

Constructs a fluent builder for the CreateKeyStore operation.

• The fluent builder is configurable:
• On success, responds with CreateKeyStoreOutput with field(s):
  • table_arn(Option<::std::string::String>): (undocumented)
• On failure, responds with SdkError<CreateKeyStoreError>

impl Client

pub fn create_key(&self) -> CreateKeyFluentBuilder

Constructs a fluent builder for the CreateKey operation.

• The fluent builder is configurable:
  • branch_key_identifier(impl Into<Option<::std::string::String>>) / set_branch_key_identifier(Option<::std::string::String>): (undocumented)
    
  • encryption_context(impl Into<Option<::std::collections::HashMap<::std::string::String, ::std::string::String>>>) / set_encryption_context(Option<::std::collections::HashMap<::std::string::String, ::std::string::String>>): (undocumented)
    
• On success, responds with CreateKeyOutput with field(s):
  • branch_key_identifier(Option<::std::string::String>): (undocumented)
• On failure, responds with SdkError<CreateKeyError>

Examples found in repository

examples/keyring/aws_kms_hierarchical/create_branch_key_id.rs (line 35)

pub async fn create_branch_key_id(
    key_store_table_name: &str,
    logical_key_store_name: &str,
    kms_key_arn: &str,
) -> Result<String, crate::BoxError> {
    // Create a Key Store
    // The KMS Configuration you use in the KeyStore MUST have the right access to the resources in the KeyStore.
    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let key_store_config = KeyStoreConfig::builder()
        .kms_client(aws_sdk_kms::Client::new(&sdk_config))
        .ddb_client(aws_sdk_dynamodb::Client::new(&sdk_config))
        .ddb_table_name(key_store_table_name)
        .logical_key_store_name(logical_key_store_name)
        .kms_configuration(KmsConfiguration::KmsKeyArn(kms_key_arn.to_string()))
        .build()?;

    let keystore = keystore_client::Client::from_conf(key_store_config)?;

    // Create a branch key identifier with the AWS KMS Key configured in the KeyStore Configuration.
    let new_key = keystore.create_key().send().await?;
    Ok(new_key.branch_key_identifier.unwrap())
}

impl Client

pub fn version_key(&self) -> VersionKeyFluentBuilder

Constructs a fluent builder for the VersionKey operation.

• The fluent builder is configurable:
  • branch_key_identifier(impl Into<Option<::std::string::String>>) / set_branch_key_identifier(Option<::std::string::String>): (undocumented)
    
• On success, responds with VersionKeyOutput with field(s):
• On failure, responds with SdkError<VersionKeyError>

Examples found in repository

examples/keyring/aws_kms_hierarchical/version_branch_key_id_example.rs (line 33)

pub async fn version_branch_key_id(
    key_store_table_name: &str,
    logical_key_store_name: &str,
    kms_key_arn: &str,
    branch_key_id: &str,
) -> Result<(), crate::BoxError> {
    // Create a Key Store
    // The KMS Configuration you use in the KeyStore MUST have the right access to the resources in the KeyStore.
    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let key_store_config = KeyStoreConfig::builder()
        .kms_client(aws_sdk_kms::Client::new(&sdk_config))
        .ddb_client(aws_sdk_dynamodb::Client::new(&sdk_config))
        .ddb_table_name(key_store_table_name)
        .logical_key_store_name(logical_key_store_name)
        .kms_configuration(KmsConfiguration::KmsKeyArn(kms_key_arn.to_string()))
        .build()?;

    let keystore = keystore_client::Client::from_conf(key_store_config)?;

    // To version a branch key you MUST have access to kms:ReEncrypt* and kms:GenerateDataKeyWithoutPlaintext
    keystore
        .version_key()
        .branch_key_identifier(branch_key_id)
        .send()
        .await?;

    println!("Version Branch Key Example Completed Successfully");

    Ok(())
}

impl Client

pub fn get_active_branch_key(&self) -> GetActiveBranchKeyFluentBuilder

Constructs a fluent builder for the GetActiveBranchKey operation.

• The fluent builder is configurable:
  • branch_key_identifier(impl Into<Option<::std::string::String>>) / set_branch_key_identifier(Option<::std::string::String>): (undocumented)
    
• On success, responds with GetActiveBranchKeyOutput with field(s):
  • branch_key_materials(Option<crate::deps::aws_cryptography_keyStore::types::BranchKeyMaterials>): (undocumented)
• On failure, responds with SdkError<GetActiveBranchKeyError>

impl Client

pub fn get_branch_key_version(&self) -> GetBranchKeyVersionFluentBuilder

Constructs a fluent builder for the GetBranchKeyVersion operation.

• The fluent builder is configurable:
  • branch_key_identifier(impl Into<Option<::std::string::String>>) / set_branch_key_identifier(Option<::std::string::String>): (undocumented)
    
  • branch_key_version(impl Into<Option<::std::string::String>>) / set_branch_key_version(Option<::std::string::String>): (undocumented)
    
• On success, responds with GetBranchKeyVersionOutput with field(s):
  • branch_key_materials(Option<crate::deps::aws_cryptography_keyStore::types::BranchKeyMaterials>): (undocumented)
• On failure, responds with SdkError<GetBranchKeyVersionError>

impl Client

pub fn get_beacon_key(&self) -> GetBeaconKeyFluentBuilder

Constructs a fluent builder for the GetBeaconKey operation.

• The fluent builder is configurable:
  • branch_key_identifier(impl Into<Option<::std::string::String>>) / set_branch_key_identifier(Option<::std::string::String>): (undocumented)
    
• On success, responds with GetBeaconKeyOutput with field(s):
  • beacon_key_materials(Option<crate::deps::aws_cryptography_keyStore::types::BeaconKeyMaterials>): (undocumented)
• On failure, responds with SdkError<GetBeaconKeyError>

impl Client

pub fn from_conf(input: KeyStoreConfig) -> Result<Self, Error>

Creates a new client from the service Config.

Examples found in repository

examples/keyring/aws_kms_hierarchical/create_branch_key_id.rs (line 32)

pub async fn create_branch_key_id(
    key_store_table_name: &str,
    logical_key_store_name: &str,
    kms_key_arn: &str,
) -> Result<String, crate::BoxError> {
    // Create a Key Store
    // The KMS Configuration you use in the KeyStore MUST have the right access to the resources in the KeyStore.
    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let key_store_config = KeyStoreConfig::builder()
        .kms_client(aws_sdk_kms::Client::new(&sdk_config))
        .ddb_client(aws_sdk_dynamodb::Client::new(&sdk_config))
        .ddb_table_name(key_store_table_name)
        .logical_key_store_name(logical_key_store_name)
        .kms_configuration(KmsConfiguration::KmsKeyArn(kms_key_arn.to_string()))
        .build()?;

    let keystore = keystore_client::Client::from_conf(key_store_config)?;

    // Create a branch key identifier with the AWS KMS Key configured in the KeyStore Configuration.
    let new_key = keystore.create_key().send().await?;
    Ok(new_key.branch_key_identifier.unwrap())
}

examples/keyring/aws_kms_hierarchical/version_branch_key_id_example.rs (line 29)

pub async fn version_branch_key_id(
    key_store_table_name: &str,
    logical_key_store_name: &str,
    kms_key_arn: &str,
    branch_key_id: &str,
) -> Result<(), crate::BoxError> {
    // Create a Key Store
    // The KMS Configuration you use in the KeyStore MUST have the right access to the resources in the KeyStore.
    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let key_store_config = KeyStoreConfig::builder()
        .kms_client(aws_sdk_kms::Client::new(&sdk_config))
        .ddb_client(aws_sdk_dynamodb::Client::new(&sdk_config))
        .ddb_table_name(key_store_table_name)
        .logical_key_store_name(logical_key_store_name)
        .kms_configuration(KmsConfiguration::KmsKeyArn(kms_key_arn.to_string()))
        .build()?;

    let keystore = keystore_client::Client::from_conf(key_store_config)?;

    // To version a branch key you MUST have access to kms:ReEncrypt* and kms:GenerateDataKeyWithoutPlaintext
    keystore
        .version_key()
        .branch_key_identifier(branch_key_id)
        .send()
        .await?;

    println!("Version Branch Key Example Completed Successfully");

    Ok(())
}

examples/keyring/aws_kms_hierarchical/aws_kms_hierarchical_keyring_example.rs (line 84)

pub async fn encrypt_and_decrypt_with_keyring(
    example_data: &str,
    key_store_table_name: &str,
    logical_key_store_name: &str,
    key_store_kms_key_id: &str,
) -> Result<(), crate::BoxError> {
    // 1. Instantiate the encryption SDK client.
    // This builds the default client with the RequireEncryptRequireDecrypt commitment policy,
    // which enforces that this client only encrypts using committing algorithm suites and enforces
    // that this client will only decrypt encrypted messages that were created with a committing
    // algorithm suite.
    let esdk_config = AwsEncryptionSdkConfig::builder().build()?;
    let esdk_client = esdk_client::Client::from_conf(esdk_config)?;

    // 2. Create a KMS client and DynamoDB client.
    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let kms_client = aws_sdk_kms::Client::new(&sdk_config);
    let ddb_client = aws_sdk_dynamodb::Client::new(&sdk_config);

    // 3. Configure your KeyStore resource.
    //    This SHOULD be the same configuration that you used
    //    to initially create and populate your KeyStore.
    let key_store_config = KeyStoreConfig::builder()
        .kms_client(kms_client)
        .ddb_client(ddb_client)
        .ddb_table_name(key_store_table_name)
        .logical_key_store_name(logical_key_store_name)
        .kms_configuration(KmsConfiguration::KmsKeyArn(
            key_store_kms_key_id.to_string(),
        ))
        .build()?;

    let key_store = keystore_client::Client::from_conf(key_store_config)?;

    // 4. Call CreateKey to create two new active branch keys
    let branch_key_id_a: String = create_branch_key_id(
        key_store_table_name,
        logical_key_store_name,
        key_store_kms_key_id,
    )
    .await?;
    let branch_key_id_b: String = create_branch_key_id(
        key_store_table_name,
        logical_key_store_name,
        key_store_kms_key_id,
    )
    .await?;

    // 5. Create a branch key supplier that maps the branch key id to a more readable format
    let branch_key_id_supplier =
        ExampleBranchKeyIdSupplier::new(&branch_key_id_a, &branch_key_id_b);

    // 6. Create the Hierarchical Keyring.
    let mpl_config = MaterialProvidersConfig::builder().build()?;
    let mpl = mpl_client::Client::from_conf(mpl_config)?;

    let hierarchical_keyring = mpl
        .create_aws_kms_hierarchical_keyring()
        .key_store(key_store.clone())
        .branch_key_id_supplier(branch_key_id_supplier)
        .ttl_seconds(600)
        .send()
        .await?;

    // 7. Create encryption context for both tenants.
    //    The Branch Key Id supplier uses the encryption context to determine which branch key id will
    //    be used to encrypt data.
    // Remember that your encryption context is NOT SECRET.
    // For more information, see
    // https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#encryption-context

    // Create encryption context for TenantA
    let encryption_context_a = HashMap::from([
        ("tenant".to_string(), "TenantA".to_string()),
        ("encryption".to_string(), "context".to_string()),
        ("is not".to_string(), "secret".to_string()),
        ("but adds".to_string(), "useful metadata".to_string()),
        (
            "that can help you".to_string(),
            "be confident that".to_string(),
        ),
        (
            "the data you are handling".to_string(),
            "is what you think it is".to_string(),
        ),
    ]);

    // Create encryption context for TenantB
    let encryption_context_b = HashMap::from([
        ("tenant".to_string(), "TenantB".to_string()),
        ("encryption".to_string(), "context".to_string()),
        ("is not".to_string(), "secret".to_string()),
        ("but adds".to_string(), "useful metadata".to_string()),
        (
            "that can help you".to_string(),
            "be confident that".to_string(),
        ),
        (
            "the data you are handling".to_string(),
            "is what you think it is".to_string(),
        ),
    ]);

    // 8. Encrypt the data with encryption_contextA & encryption_contextB
    let plaintext = example_data.as_bytes();

    let encryption_response_a = esdk_client
        .encrypt()
        .plaintext(plaintext)
        .keyring(hierarchical_keyring.clone())
        .encryption_context(encryption_context_a.clone())
        .send()
        .await?;

    let ciphertext_a = encryption_response_a
        .ciphertext
        .expect("Unable to unwrap ciphertext from encryption response");

    let encryption_response_b = esdk_client
        .encrypt()
        .plaintext(plaintext)
        .keyring(hierarchical_keyring.clone())
        .encryption_context(encryption_context_b.clone())
        .send()
        .await?;

    let ciphertext_b = encryption_response_b
        .ciphertext
        .expect("Unable to unwrap ciphertext from encryption response");

    // 9. Demonstrate that the ciphertexts and plaintext are different.
    // (This is an example for demonstration; you do not need to do this in your own code.)
    assert_ne!(
        ciphertext_a,
        aws_smithy_types::Blob::new(plaintext),
        "Ciphertext and plaintext data are the same. Invalid encryption"
    );

    assert_ne!(
        ciphertext_b,
        aws_smithy_types::Blob::new(plaintext),
        "Ciphertext and plaintext data are the same. Invalid encryption"
    );

    // 10. To attest that TenantKeyB cannot decrypt a message written by TenantKeyA,
    //    and vice versa, let's construct more restrictive hierarchical keyrings.
    let hierarchical_keyring_a = mpl
        .create_aws_kms_hierarchical_keyring()
        .key_store(key_store.clone())
        .branch_key_id(branch_key_id_a)
        .ttl_seconds(600)
        .send()
        .await?;

    let hierarchical_keyring_b = mpl
        .create_aws_kms_hierarchical_keyring()
        .key_store(key_store)
        .branch_key_id(branch_key_id_b)
        .ttl_seconds(600)
        .send()
        .await?;

    // 11. Demonstrate that data encrypted by one tenant's key
    // cannot be decrypted with by a keyring specific to another tenant.

    // Keyring with tenant B's branch key cannot decrypt data encrypted with tenant A's branch key
    // This will fail and raise a AwsCryptographicMaterialProvidersError,
    // which we swallow ONLY for demonstration purposes.
    let decryption_response_mismatch_1 = esdk_client
        .decrypt()
        .ciphertext(ciphertext_a.clone())
        .keyring(hierarchical_keyring_b.clone())
        // Provide the encryption context that was supplied to the encrypt method
        .encryption_context(encryption_context_a.clone())
        .send()
        .await;

    match decryption_response_mismatch_1 {
        Ok(_) => panic!(
            "Decrypt with wrong tenant's hierarchical keyring MUST \
                            raise AwsCryptographicMaterialProvidersError"
        ),
        Err(AwsCryptographicMaterialProvidersError { error: _e }) => (),
        _ => panic!("Unexpected error type"),
    }

    // Keyring with tenant A's branch key cannot decrypt data encrypted with tenant B's branch key.
    // This will fail and raise a AwsCryptographicMaterialProvidersError,
    // which we swallow ONLY for demonstration purposes.
    let decryption_response_mismatch_2 = esdk_client
        .decrypt()
        .ciphertext(ciphertext_b.clone())
        .keyring(hierarchical_keyring_a.clone())
        // Provide the encryption context that was supplied to the encrypt method
        .encryption_context(encryption_context_b.clone())
        .send()
        .await;

    match decryption_response_mismatch_2 {
        Ok(_) => panic!(
            "Decrypt with wrong tenant's hierarchical keyring MUST \
                            raise AwsCryptographicMaterialProvidersError"
        ),
        Err(AwsCryptographicMaterialProvidersError { error: _e }) => (),
        _ => panic!("Unexpected error type"),
    }

    // 12. Demonstrate that data encrypted by one tenant's branch key can be decrypted by that tenant,
    //     and that the decrypted data matches the input data.
    let decryption_response_a = esdk_client
        .decrypt()
        .ciphertext(ciphertext_a)
        .keyring(hierarchical_keyring_a)
        // Provide the encryption context that was supplied to the encrypt method
        .encryption_context(encryption_context_a)
        .send()
        .await?;

    let decrypted_plaintext_a = decryption_response_a
        .plaintext
        .expect("Unable to unwrap plaintext from decryption response");

    // Demonstrate that the decrypted plaintext is identical to the original plaintext.
    // (This is an example for demonstration; you do not need to do this in your own code.)
    assert_eq!(
        decrypted_plaintext_a,
        aws_smithy_types::Blob::new(plaintext),
        "Decrypted plaintext should be identical to the original plaintext. Invalid decryption"
    );

    // Similarly for TenantB
    let decryption_response_b = esdk_client
        .decrypt()
        .ciphertext(ciphertext_b)
        .keyring(hierarchical_keyring_b)
        // Provide the encryption context that was supplied to the encrypt method
        .encryption_context(encryption_context_b)
        .send()
        .await?;

    let decrypted_plaintext_b = decryption_response_b
        .plaintext
        .expect("Unable to unwrap plaintext from decryption response");

    // Demonstrate that the decrypted plaintext is identical to the original plaintext.
    // (This is an example for demonstration; you do not need to do this in your own code.)
    assert_eq!(
        decrypted_plaintext_b,
        aws_smithy_types::Blob::new(plaintext),
        "Decrypted plaintext should be identical to the original plaintext. Invalid decryption"
    );

    println!("Hierarchical Keyring Example Completed Successfully");

    Ok(())
}

examples/keyring/aws_kms_hierarchical/shared_cache_across_hierarchical_keyrings_example.rs (line 135)

pub async fn encrypt_and_decrypt_with_keyring(
    example_data: &str,
    key_store_table_name: &str,
    logical_key_store_name: &str,
    key_store_kms_key_id: &str,
) -> Result<(), crate::BoxError> {
    // 1a. Create the CryptographicMaterialsCache (CMC) to share across multiple Hierarchical Keyrings
    // using the Material Providers Library
    //    This CMC takes in:
    //     - CacheType
    let mpl_config = MaterialProvidersConfig::builder().build()?;
    let mpl = mpl_client::Client::from_conf(mpl_config)?;

    let cache: CacheType = CacheType::Default(DefaultCache::builder().entry_capacity(100).build()?);

    let shared_cryptographic_materials_cache: CryptographicMaterialsCacheRef = mpl
        .create_cryptographic_materials_cache()
        .cache(cache)
        .send()
        .await?;

    // 1b. Create a CacheType object for the shared_cryptographic_materials_cache
    // Note that the `cache` parameter in the Hierarchical Keyring Input takes a `CacheType` as input
    // Here, we pass a `Shared` CacheType that passes an already initialized shared cache.

    // If you want to use a Shared Cache, you need to initialize it only once, and
    // pass the same cache `shared_cache` to different hierarchical keyrings.

    // CryptographicMaterialsCacheRef is an Rc (Reference Counted), so if you clone it to
    // pass it to different Hierarchical Keyrings, it will still point to the same
    // underlying cache, and increment the reference count accordingly.
    let shared_cache: CacheType = CacheType::Shared(shared_cryptographic_materials_cache);

    // 2. Instantiate the encryption SDK client.
    // This builds the default client with the RequireEncryptRequireDecrypt commitment policy,
    // which enforces that this client only encrypts using committing algorithm suites and enforces
    // that this client will only decrypt encrypted messages that were created with a committing
    // algorithm suite.
    let esdk_config = AwsEncryptionSdkConfig::builder().build()?;
    let esdk_client = esdk_client::Client::from_conf(esdk_config)?;

    // 3. Configure your Key Store resource key_store1.
    //    This SHOULD be the same configuration that you used
    //    to initially create and populate your physical Key Store.
    // Note that key_store_table_name is the physical Key Store,
    // and key_store1 is instances of this physical Key Store.
    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let key_store_config = KeyStoreConfig::builder()
        .kms_client(aws_sdk_kms::Client::new(&sdk_config))
        .ddb_client(aws_sdk_dynamodb::Client::new(&sdk_config))
        .ddb_table_name(key_store_table_name)
        .logical_key_store_name(logical_key_store_name)
        .kms_configuration(KmsConfiguration::KmsKeyArn(
            key_store_kms_key_id.to_string(),
        ))
        .build()?;

    let key_store1 = keystore_client::Client::from_conf(key_store_config.clone())?;

    // 4. Call create_branch_key_id to create one new active branch key
    let branch_key_id: String = create_branch_key_id(
        key_store_table_name,
        logical_key_store_name,
        key_store_kms_key_id,
    )
    .await?;

    // 5. Create the Hierarchical Keyring HK1 with Key Store instance K1, partition_id,
    // the shared_cache and the branch_key_id.
    // Note that we are now providing an already initialized shared cache instead of just mentioning
    // the cache type and the Hierarchical Keyring initializing a cache at initialization.

    // partition_id for this example is a random UUID
    let partition_id = "91c1b6a2-6fc3-4539-ad5e-938d597ed730".to_string();

    // Please make sure that you read the guidance on how to set Partition ID, Logical Key Store Name and
    // Branch Key ID at the top of this example before creating Hierarchical Keyrings with a Shared Cache
    let keyring1 = mpl
        .create_aws_kms_hierarchical_keyring()
        .key_store(key_store1)
        .branch_key_id(branch_key_id.clone())
        // CryptographicMaterialsCacheRef is an Rc (Reference Counted), so if you clone it to
        // pass it to different Hierarchical Keyrings, it will still point to the same
        // underlying cache, and increment the reference count accordingly.
        .cache(shared_cache.clone())
        .ttl_seconds(600)
        .partition_id(partition_id.clone())
        .send()
        .await?;

    // 6. Create encryption context.
    // Remember that your encryption context is NOT SECRET.
    // For more information, see
    // https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#encryption-context
    let encryption_context = HashMap::from([
        ("encryption".to_string(), "context".to_string()),
        ("is not".to_string(), "secret".to_string()),
        ("but adds".to_string(), "useful metadata".to_string()),
        (
            "that can help you".to_string(),
            "be confident that".to_string(),
        ),
        (
            "the data you are handling".to_string(),
            "is what you think it is".to_string(),
        ),
    ]);

    // 7. Encrypt the data for encryption_context using keyring1
    let plaintext = example_data.as_bytes();

    let encryption_response1 = esdk_client
        .encrypt()
        .plaintext(plaintext)
        .keyring(keyring1.clone())
        .encryption_context(encryption_context.clone())
        .send()
        .await?;

    let ciphertext1 = encryption_response1
        .ciphertext
        .expect("Unable to unwrap ciphertext from encryption response");

    // 8. Demonstrate that the ciphertexts and plaintext are different.
    // (This is an example for demonstration; you do not need to do this in your own code.)
    assert_ne!(
        ciphertext1,
        aws_smithy_types::Blob::new(plaintext),
        "Ciphertext and plaintext data are the same. Invalid encryption"
    );

    // 9. Decrypt your encrypted data using the same keyring HK1 you used on encrypt.
    let decryption_response1 = esdk_client
        .decrypt()
        .ciphertext(ciphertext1)
        .keyring(keyring1)
        // Provide the encryption context that was supplied to the encrypt method
        .encryption_context(encryption_context.clone())
        .send()
        .await?;

    let decrypted_plaintext1 = decryption_response1
        .plaintext
        .expect("Unable to unwrap plaintext from decryption response");

    // 10. Demonstrate that the decrypted plaintext is identical to the original plaintext.
    // (This is an example for demonstration; you do not need to do this in your own code.)
    assert_eq!(
        decrypted_plaintext1,
        aws_smithy_types::Blob::new(plaintext),
        "Decrypted plaintext should be identical to the original plaintext. Invalid decryption"
    );

    // 11. Through the above encrypt and decrypt roundtrip, the cache will be populated and
    // the cache entries can be used by another Hierarchical Keyring with the
    // - Same Partition ID
    // - Same Logical Key Store Name of the Key Store for the Hierarchical Keyring
    // - Same Branch Key ID

    // Configure your Key Store resource key_store2.
    //    This SHOULD be the same configuration that you used
    //    to initially create and populate your physical Key Store.
    // Note that key_store_table_name is the physical Key Store,
    // and key_store2 is instances of this physical Key Store.

    // Note that for this example, key_store2 is identical to key_store1.
    // You can optionally change configurations like KMS Client or KMS Key ID based
    // on your use-case.
    // Make sure you have the required permissions to use different configurations.

    // - If you want to share cache entries across two keyrings HK1 and HK2,
    //   you should set the Logical Key Store Names for both
    //   Key Store instances (K1 and K2) to be the same.
    // - If you set the Logical Key Store Names for K1 and K2 to be different,
    //   HK1 (which uses Key Store instance K1) and HK2 (which uses Key Store
    //   instance K2) will NOT be able to share cache entries.
    let key_store2 = keystore_client::Client::from_conf(key_store_config.clone())?;

    // 12. Create the Hierarchical Keyring HK2 with Key Store instance K2, the shared_cache
    // and the same partition_id and branch_key_id used in HK1 because we want to share cache entries
    // (and experience cache HITS).

    // Please make sure that you read the guidance on how to set Partition ID, Logical Key Store Name and
    // Branch Key ID at the top of this example before creating Hierarchical Keyrings with a Shared Cache
    let keyring2 = mpl
        .create_aws_kms_hierarchical_keyring()
        .key_store(key_store2)
        .branch_key_id(branch_key_id)
        .cache(shared_cache)
        .ttl_seconds(600)
        .partition_id(partition_id)
        .send()
        .await?;

    // 13. This encrypt-decrypt roundtrip with HK2 will experience Cache HITS from previous HK1 roundtrip
    // Encrypt the data for encryption_context using keyring2
    let encryption_response2 = esdk_client
        .encrypt()
        .plaintext(plaintext)
        .keyring(keyring2.clone())
        .encryption_context(encryption_context.clone())
        .send()
        .await?;

    let ciphertext2 = encryption_response2
        .ciphertext
        .expect("Unable to unwrap ciphertext from encryption response");

    // 14. Demonstrate that the ciphertexts and plaintext are different.
    // (This is an example for demonstration; you do not need to do this in your own code.)
    assert_ne!(
        ciphertext2,
        aws_smithy_types::Blob::new(plaintext),
        "Ciphertext and plaintext data are the same. Invalid encryption"
    );

    // 15. Decrypt your encrypted data using the same keyring HK2 you used on encrypt.
    let decryption_response2 = esdk_client
        .decrypt()
        .ciphertext(ciphertext2)
        .keyring(keyring2)
        // Provide the encryption context that was supplied to the encrypt method
        .encryption_context(encryption_context)
        .send()
        .await?;

    let decrypted_plaintext2 = decryption_response2
        .plaintext
        .expect("Unable to unwrap plaintext from decryption response");

    // 10. Demonstrate that the decrypted plaintext is identical to the original plaintext.
    // (This is an example for demonstration; you do not need to do this in your own code.)
    assert_eq!(
        decrypted_plaintext2,
        aws_smithy_types::Blob::new(plaintext),
        "Decrypted plaintext should be identical to the original plaintext. Invalid decryption"
    );

    println!("Shared Cache Across Hierarchical Keyrings Example Completed Successfully");

    Ok(())
}

Trait Implementations

impl Clone for Client

fn clone(&self) -> Client

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Client

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Client

fn eq(&self, other: &Client) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Client