main/keyring/aws_kms_hierarchical/
create_branch_key_id.rs

1// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2// SPDX-License-Identifier: Apache-2.0
3
4use aws_esdk::key_store::client as keystore_client;
5use aws_esdk::key_store::types::key_store_config::KeyStoreConfig;
6use aws_esdk::key_store::types::KmsConfiguration;
7
8/*
9 The Hierarchical Keyring Example relies on the existence
10 of a DDB-backed key store with pre-existing
11 branch key material.
12
13 This example demonstrates configuring a KeyStore and then
14 uses a helper method to create a branch key.
15*/
16pub async fn create_branch_key_id(
17    key_store_table_name: &str,
18    logical_key_store_name: &str,
19    kms_key_arn: &str,
20) -> Result<String, crate::BoxError> {
21    // Create a Key Store
22    // The KMS Configuration you use in the KeyStore MUST have the right access to the resources in the KeyStore.
23    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
24    let key_store_config = KeyStoreConfig::builder()
25        .kms_client(aws_sdk_kms::Client::new(&sdk_config))
26        .ddb_client(aws_sdk_dynamodb::Client::new(&sdk_config))
27        .ddb_table_name(key_store_table_name)
28        .logical_key_store_name(logical_key_store_name)
29        .kms_configuration(KmsConfiguration::KmsKeyArn(kms_key_arn.to_string()))
30        .build()?;
31
32    let keystore = keystore_client::Client::from_conf(key_store_config)?;
33
34    // Create a branch key identifier with the AWS KMS Key configured in the KeyStore Configuration.
35    let new_key = keystore.create_key().send().await?;
36    Ok(new_key.branch_key_identifier.unwrap())
37}
main/keyring/aws_kms_hierarchical/create_branch_key_id.rs

main/keyring/aws_kms_hierarchical/
create_branch_key_id.rs
