@aws-crypto/kms-keyring - npm Package Compare versions

Comparing version 1.1.1 to 1.7.0

build/main/helpers.js

@@ -5,2 +5,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.kmsResponseToEncryptedDataKey = exports.decrypt = exports.encrypt = exports.generateDataKey = exports.KMS_PROVIDER_ID = void 0;
 const region_from_kms_key_arn_1 = require("./region_from_kms_key_arn");
@@ -51,3 +52,5 @@ const material_management_1 = require("@aws-crypto/material-management");
         return false;
+    /* The AWS KMS KeyId *must* be set. */
     const v2vsV3Response = client.decrypt({
+        KeyId: providerInfo,
         CiphertextBlob: encryptedDataKey,
@@ -103,2 +106,2 @@ EncryptionContext,
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9oZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQSxvRUFBb0U7QUFDcEUsc0NBQXNDOztBQVl0Qyx1RUFBK0Q7QUFDL0QseUVBSXdDO0FBRTNCLFFBQUEsZUFBZSxHQUFHLFNBQVMsQ0FBQTtBQUVqQyxLQUFLLFVBQVUsZUFBZSxDQUNuQyxjQUF5QyxFQUN6QyxhQUFxQixFQUNyQixLQUFhLEVBQ2IsaUJBQW9DLEVBQ3BDLFdBQXNCO0lBRXRCLE1BQU0sTUFBTSxHQUFHLDZDQUFtQixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ3pDLE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUVyQyx5R0FBeUc7SUFDekcsSUFBSSxDQUFDLE1BQU07UUFBRSxPQUFPLEtBQUssQ0FBQTtJQUN6QixNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsZUFBZSxDQUFDO1FBQzVDLEtBQUs7UUFDTCxXQUFXO1FBQ1gsYUFBYTtRQUNiLGlCQUFpQjtLQUNsQixDQUFDLENBQUE7SUFDRixNQUFNLGFBQWEsR0FDakIsU0FBUyxJQUFJLGNBQWMsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUE7SUFDekUsTUFBTSxPQUFPLEdBQUcsTUFBTSxhQUFhLENBQUE7SUFFbkMsT0FBTyxtQkFBbUIsQ0FBQyxPQUFPLENBQUMsQ0FBQTtBQUNyQyxDQUFDO0FBdkJELDBDQXVCQztBQUVNLEtBQUssVUFBVSxPQUFPLENBQzNCLGNBQXlDLEVBQ3pDLFNBQXFCLEVBQ3JCLEtBQWEsRUFDYixpQkFBb0MsRUFDcEMsV0FBc0I7SUFFdEIsTUFBTSxNQUFNLEdBQUcsNkNBQW1CLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDekMsTUFBTSxNQUFNLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBRXJDLGlHQUFpRztJQUNqRyxJQUFJLENBQUMsTUFBTTtRQUFFLE9BQU8sS0FBSyxDQUFBO0lBRXpCLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUM7UUFDcEMsS0FBSztRQUNMLFNBQVM7UUFDVCxpQkFBaUI7UUFDakIsV0FBVztLQUNaLENBQUMsQ0FBQTtJQUNGLE1BQU0sYUFBYSxHQUNqQixTQUFTLElBQUksY0FBYyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQTtJQUN6RSxNQUFNLE1BQU0sR0FBRyxNQUFNLGFBQWEsQ0FBQTtJQUVsQyxPQUFPLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxDQUFBO0FBQ2xDLENBQUM7QUF4QkQsMEJBd0JDO0FBRU0sS0FBSyxVQUFVLE9BQU8sQ0FDM0IsY0FBeUMsRUFDekMsRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFvQixFQUNoRSxpQkFBb0MsRUFDcEMsV0FBc0I7SUFFdEIsK0NBQStDO0lBQy9DLDJCQUFLLENBQUMsVUFBVSxLQUFLLHVCQUFlLEVBQUUsd0JBQXdCLENBQUMsQ0FBQTtJQUMvRCxNQUFNLE1BQU0sR0FBRyw2Q0FBbUIsQ0FBQyxZQUFZLENBQUMsQ0FBQTtJQUNoRCxNQUFNLE1BQU0sR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUE7SUFDckMsaUdBQWlHO0lBQ2pHLElBQUksQ0FBQyxNQUFNO1FBQUUsT0FBTyxLQUFLLENBQUE7SUFFekIsTUFBTSxjQUFjLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUNwQyxjQUFjLEVBQUUsZ0JBQWdCO1FBQ2hDLGlCQUFpQjtRQUNqQixXQUFXO0tBQ1osQ0FBQyxDQUFBO0lBQ0YsTUFBTSxhQUFhLEdBQ2pCLFNBQVMsSUFBSSxjQUFjLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFBO0lBQ3pFLE1BQU0sT0FBTyxHQUFHLE1BQU0sYUFBYSxDQUFBO0lBRW5DLE9BQU8saUJBQWlCLENBQUMsT0FBTyxDQUFDLENBQUE7QUFDbkMsQ0FBQztBQXZCRCwwQkF1QkM7QUFFRCxTQUFnQiw2QkFBNkIsQ0FBQyxFQUM1QyxLQUFLLEVBQUUsWUFBWSxFQUNuQixjQUFjLEVBQUUsZ0JBQWdCLEdBQ1I7SUFDeEIsT0FBTyxJQUFJLHNDQUFnQixDQUFDO1FBQzFCLFVBQVUsRUFBRSx1QkFBZTtRQUMzQixZQUFZO1FBQ1osZ0JBQWdCO0tBQ2pCLENBQUMsQ0FBQTtBQUNKLENBQUM7QUFURCxzRUFTQztBQUVELFNBQVMsbUJBQW1CLENBQzFCLE9BQWdDO0lBRWhDLG9FQUFvRTtJQUNwRSwyQkFBSyxDQUNILE9BQU8sT0FBTyxDQUFDLEtBQUssS0FBSyxRQUFRO1FBQy9CLE9BQU8sQ0FBQyxTQUFTLFlBQVksVUFBVTtRQUN2QyxPQUFPLENBQUMsY0FBYyxZQUFZLFVBQVUsRUFDOUMseUJBQXlCLENBQzFCLENBQUE7SUFFRCxPQUFPLGFBQWEsQ0FDbEIsT0FBMEMsQ0FDUixDQUFBO0FBQ3RDLENBQUM7QUFFRCxTQUFTLGlCQUFpQixDQUFDLE9BQXdCO0lBQ2pELHFFQUFxRTtJQUNyRSwyQkFBSyxDQUNILE9BQU8sT0FBTyxDQUFDLEtBQUssS0FBSyxRQUFRO1FBQy9CLE9BQU8sQ0FBQyxjQUFjLFlBQVksVUFBVSxFQUM5Qyx5QkFBeUIsQ0FDMUIsQ0FBQTtJQUVELE9BQU8sT0FBa0MsQ0FBQTtBQUMzQyxDQUFDO0FBRUQsU0FBUyxpQkFBaUIsQ0FBQyxPQUF3QjtJQUNqRCwwREFBMEQ7SUFDMUQsMkJBQUssQ0FDSCxPQUFPLE9BQU8sQ0FBQyxLQUFLLEtBQUssUUFBUTtRQUMvQixPQUFPLENBQUMsU0FBUyxZQUFZLFVBQVUsRUFDekMseUJBQXlCLENBQzFCLENBQUE7SUFFRCxPQUFPLGFBQWEsQ0FDbEIsT0FBa0MsQ0FDUixDQUFBO0FBQzlCLENBQUM7QUFFRCxTQUFTLGFBQWEsQ0FDcEIsT0FBa0U7SUFFbEU7Ozs7Ozs7T0FPRztJQUNILE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxPQUFPLENBQUE7SUFDN0IsT0FBTyxDQUFDLFNBQVMsR0FBRyxJQUFJLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQTtJQUM3QyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFBO0lBQ2pCLE9BQU8sT0FBTyxDQUFBO0FBQ2hCLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9oZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQSxvRUFBb0U7QUFDcEUsc0NBQXNDOzs7QUFZdEMsdUVBQStEO0FBQy9ELHlFQUl3QztBQUUzQixRQUFBLGVBQWUsR0FBRyxTQUFTLENBQUE7QUFFakMsS0FBSyxVQUFVLGVBQWUsQ0FDbkMsY0FBeUMsRUFDekMsYUFBcUIsRUFDckIsS0FBYSxFQUNiLGlCQUFvQyxFQUNwQyxXQUFzQjtJQUV0QixNQUFNLE1BQU0sR0FBRyw2Q0FBbUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUN6QyxNQUFNLE1BQU0sR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUE7SUFFckMseUdBQXlHO0lBQ3pHLElBQUksQ0FBQyxNQUFNO1FBQUUsT0FBTyxLQUFLLENBQUE7SUFDekIsTUFBTSxjQUFjLEdBQUcsTUFBTSxDQUFDLGVBQWUsQ0FBQztRQUM1QyxLQUFLO1FBQ0wsV0FBVztRQUNYLGFBQWE7UUFDYixpQkFBaUI7S0FDbEIsQ0FBQyxDQUFBO0lBQ0YsTUFBTSxhQUFhLEdBQ2pCLFNBQVMsSUFBSSxjQUFjLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFBO0lBQ3pFLE1BQU0sT0FBTyxHQUFHLE1BQU0sYUFBYSxDQUFBO0lBRW5DLE9BQU8sbUJBQW1CLENBQUMsT0FBTyxDQUFDLENBQUE7QUFDckMsQ0FBQztBQXZCRCwwQ0F1QkM7QUFFTSxLQUFLLFVBQVUsT0FBTyxDQUMzQixjQUF5QyxFQUN6QyxTQUFxQixFQUNyQixLQUFhLEVBQ2IsaUJBQW9DLEVBQ3BDLFdBQXNCO0lBRXRCLE1BQU0sTUFBTSxHQUFHLDZDQUFtQixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ3pDLE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUVyQyxpR0FBaUc7SUFDakcsSUFBSSxDQUFDLE1BQU07UUFBRSxPQUFPLEtBQUssQ0FBQTtJQUV6QixNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQ3BDLEtBQUs7UUFDTCxTQUFTO1FBQ1QsaUJBQWlCO1FBQ2pCLFdBQVc7S0FDWixDQUFDLENBQUE7SUFDRixNQUFNLGFBQWEsR0FDakIsU0FBUyxJQUFJLGNBQWMsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUE7SUFDekUsTUFBTSxNQUFNLEdBQUcsTUFBTSxhQUFhLENBQUE7SUFFbEMsT0FBTyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsQ0FBQTtBQUNsQyxDQUFDO0FBeEJELDBCQXdCQztBQUVNLEtBQUssVUFBVSxPQUFPLENBQzNCLGNBQXlDLEVBQ3pDLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBb0IsRUFDaEUsaUJBQW9DLEVBQ3BDLFdBQXNCO0lBRXRCLCtDQUErQztJQUMvQywyQkFBSyxDQUFDLFVBQVUsS0FBSyx1QkFBZSxFQUFFLHdCQUF3QixDQUFDLENBQUE7SUFDL0QsTUFBTSxNQUFNLEdBQUcsNkNBQW1CLENBQUMsWUFBWSxDQUFDLENBQUE7SUFDaEQsTUFBTSxNQUFNLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQ3JDLGlHQUFpRztJQUNqRyxJQUFJLENBQUMsTUFBTTtRQUFFLE9BQU8sS0FBSyxDQUFBO0lBRXpCLHNDQUFzQztJQUN0QyxNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQ3BDLEtBQUssRUFBRSxZQUFZO1FBQ25CLGNBQWMsRUFBRSxnQkFBZ0I7UUFDaEMsaUJBQWlCO1FBQ2pCLFdBQVc7S0FDWixDQUFDLENBQUE7SUFDRixNQUFNLGFBQWEsR0FDakIsU0FBUyxJQUFJLGNBQWMsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUE7SUFDekUsTUFBTSxPQUFPLEdBQUcsTUFBTSxhQUFhLENBQUE7SUFFbkMsT0FBTyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsQ0FBQTtBQUNuQyxDQUFDO0FBekJELDBCQXlCQztBQUVELFNBQWdCLDZCQUE2QixDQUFDLEVBQzVDLEtBQUssRUFBRSxZQUFZLEVBQ25CLGNBQWMsRUFBRSxnQkFBZ0IsR0FDUjtJQUN4QixPQUFPLElBQUksc0NBQWdCLENBQUM7UUFDMUIsVUFBVSxFQUFFLHVCQUFlO1FBQzNCLFlBQVk7UUFDWixnQkFBZ0I7S0FDakIsQ0FBQyxDQUFBO0FBQ0osQ0FBQztBQVRELHNFQVNDO0FBRUQsU0FBUyxtQkFBbUIsQ0FDMUIsT0FBZ0M7SUFFaEMsb0VBQW9FO0lBQ3BFLDJCQUFLLENBQ0gsT0FBTyxPQUFPLENBQUMsS0FBSyxLQUFLLFFBQVE7UUFDL0IsT0FBTyxDQUFDLFNBQVMsWUFBWSxVQUFVO1FBQ3ZDLE9BQU8sQ0FBQyxjQUFjLFlBQVksVUFBVSxFQUM5Qyx5QkFBeUIsQ0FDMUIsQ0FBQTtJQUVELE9BQU8sYUFBYSxDQUNsQixPQUEwQyxDQUNSLENBQUE7QUFDdEMsQ0FBQztBQUVELFNBQVMsaUJBQWlCLENBQUMsT0FBd0I7SUFDakQscUVBQXFFO0lBQ3JFLDJCQUFLLENBQ0gsT0FBTyxPQUFPLENBQUMsS0FBSyxLQUFLLFFBQVE7UUFDL0IsT0FBTyxDQUFDLGNBQWMsWUFBWSxVQUFVLEVBQzlDLHlCQUF5QixDQUMxQixDQUFBO0lBRUQsT0FBTyxPQUFrQyxDQUFBO0FBQzNDLENBQUM7QUFFRCxTQUFTLGlCQUFpQixDQUFDLE9BQXdCO0lBQ2pELDBEQUEwRDtJQUMxRCwyQkFBSyxDQUNILE9BQU8sT0FBTyxDQUFDLEtBQUssS0FBSyxRQUFRO1FBQy9CLE9BQU8sQ0FBQyxTQUFTLFlBQVksVUFBVSxFQUN6Qyx5QkFBeUIsQ0FDMUIsQ0FBQTtJQUVELE9BQU8sYUFBYSxDQUNsQixPQUFrQyxDQUNSLENBQUE7QUFDOUIsQ0FBQztBQUVELFNBQVMsYUFBYSxDQUNwQixPQUFrRTtJQUVsRTs7Ozs7OztPQU9HO0lBQ0gsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLE9BQU8sQ0FBQTtJQUM3QixPQUFPLENBQUMsU0FBUyxHQUFHLElBQUksVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFBO0lBQzdDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDakIsT0FBTyxPQUFPLENBQUE7QUFDaEIsQ0FBQyJ9

build/main/index.js

 "use strict";
 // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-function __export(m) {
-    for (var p in m) if (!exports.hasOwnProperty(p)) exports[p] = m[p];
-}
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-__export(require("./kms_client_supplier"));
-__export(require("./kms_keyring"));
-__export(require("./helpers"));
-__export(require("./region_from_kms_key_arn"));
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7Ozs7O0FBRXRDLDJDQUFxQztBQUNyQyxtQ0FBNkI7QUFDN0IsK0JBQXlCO0FBQ3pCLCtDQUF5QyJ9
+__exportStar(require("./kms_client_supplier"), exports);
+__exportStar(require("./kms_keyring"), exports);
+__exportStar(require("./helpers"), exports);
+__exportStar(require("./region_from_kms_key_arn"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7Ozs7Ozs7Ozs7OztBQUV0Qyx3REFBcUM7QUFDckMsZ0RBQTZCO0FBQzdCLDRDQUF5QjtBQUN6Qiw0REFBeUMifQ==

build/main/kms_client_supplier.js

@@ -5,2 +5,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.deferCache = exports.cacheClients = exports.excludeRegions = exports.limitRegions = exports.getClient = void 0;
 const material_management_1 = require("@aws-crypto/material-management");
@@ -113,2 +114,2 @@ function getClient(KMSClient, defaultConfig) {
 exports.deferCache = deferCache;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX2NsaWVudF9zdXBwbGllci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9rbXNfY2xpZW50X3N1cHBsaWVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQSxvRUFBb0U7QUFDcEUsc0NBQXNDOztBQUV0Qyx5RUFBdUQ7QUF1QnZELFNBQWdCLFNBQVMsQ0FDdkIsU0FBMkMsRUFDM0MsYUFBc0I7SUFFdEIsT0FBTyxTQUFTLFlBQVksQ0FBQyxNQUFjO1FBQ3pDOzs7V0FHRztRQUNILE1BQU0sTUFBTSxHQUFHLENBQUMsTUFBTTtZQUNwQixDQUFDLENBQUMsRUFBRSxHQUFHLGFBQWEsRUFBRSxNQUFNLEVBQUU7WUFDOUIsQ0FBQyxDQUFDLEVBQUUsR0FBRyxhQUFhLEVBQUUsQ0FBVyxDQUFBO1FBQ25DLE1BQU0sTUFBTSxHQUFHLElBQUksU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFBO1FBRXBDOzs7O1dBSUc7UUFDSCw4RkFBOEY7UUFDOUYsMkJBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxzQkFBc0IsQ0FBQyxDQUFBO1FBQ25ELE9BQU8sTUFBTSxDQUFBO0lBQ2YsQ0FBQyxDQUFBO0FBQ0gsQ0FBQztBQXZCRCw4QkF1QkM7QUFFRCxTQUFnQixZQUFZLENBQzFCLE9BQWlCLEVBQ2pCLFNBQW9DO0lBRXBDLGtFQUFrRTtJQUNsRSwyQkFBSyxDQUNILE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLEtBQUssUUFBUSxDQUFDLEVBQ2xELGtDQUFrQyxDQUNuQyxDQUFBO0lBRUQsT0FBTyxDQUFDLE1BQWMsRUFBRSxFQUFFO1FBQ3hCLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFBO1FBQzNDLE9BQU8sU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQzFCLENBQUMsQ0FBQTtBQUNILENBQUM7QUFkRCxvQ0FjQztBQUVELFNBQWdCLGNBQWMsQ0FDNUIsT0FBaUIsRUFDakIsU0FBb0M7SUFFcEMsK0RBQStEO0lBQy9ELDJCQUFLLENBQ0gsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxPQUFPLENBQUMsS0FBSyxRQUFRLENBQUMsRUFDbEQsb0NBQW9DLENBQ3JDLENBQUE7SUFFRCxPQUFPLENBQUMsTUFBYyxFQUFFLEVBQUU7UUFDeEIsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFBO1FBQzFDLE9BQU8sU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQzFCLENBQUMsQ0FBQTtBQUNILENBQUM7QUFkRCx3Q0FjQztBQUVELFNBQWdCLFlBQVksQ0FDMUIsU0FBb0M7SUFFcEMsTUFBTSxZQUFZLEdBQXNDLEVBQUUsQ0FBQTtJQUUxRCxPQUFPLENBQUMsTUFBYyxFQUFFLEVBQUU7UUFDeEIsZ0VBQWdFO1FBQ2hFLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQztZQUM3RCxPQUFPLFVBQVUsQ0FBQyxZQUFZLEVBQUUsTUFBTSxFQUFFLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFBO1FBQzVELE9BQU8sWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQzdCLENBQUMsQ0FBQTtBQUNILENBQUM7QUFYRCxvQ0FXQztBQUVEOzs7Ozs7R0FNRztBQUNILFNBQWdCLFVBQVUsQ0FDeEIsWUFBK0MsRUFDL0MsTUFBYyxFQUNkLE1BQXNCO0lBRXRCLHdGQUF3RjtJQUN4RixJQUFJLENBQUMsTUFBTSxFQUFFO1FBQ1gsWUFBWSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEtBQUssQ0FBQTtRQUM1QixPQUFPLEtBQUssQ0FBQTtLQUNiO0lBQ0QsTUFBTSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsZUFBZSxFQUFFLEdBQUcsTUFBTSxDQUFBO0lBRXBELE9BQVE7UUFDTixTQUFTO1FBQ1QsU0FBUztRQUNULGlCQUFpQjtLQUNnQixDQUFDLE1BQU0sQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLENBQUE7SUFFakUsaUVBQWlFO0lBQ2pFLFNBQVMsYUFBYSxDQUNwQixNQUFjLEVBQ2QsSUFBK0I7UUFFL0IsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFBO1FBQzdCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLFVBQVUsZ0JBQWdCLENBRTVDLElBQVM7WUFFVCw4REFBOEQ7WUFDOUQsTUFBTSxjQUFjLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUE7WUFDbEQsTUFBTSxhQUFhLEdBQ2pCLFNBQVMsSUFBSSxjQUFjLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFBO1lBQ3pFLE9BQU8sYUFBYTtpQkFDakIsSUFBSSxDQUFDLENBQUMsUUFBYSxFQUFFLEVBQUU7Z0JBQ3RCLFlBQVksQ0FBQyxNQUFNLENBQUMsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRTtvQkFDM0MsT0FBTztvQkFDUCxPQUFPO29CQUNQLGVBQWU7aUJBQ2hCLENBQUMsQ0FBQTtnQkFDRixPQUFPLFFBQVEsQ0FBQTtZQUNqQixDQUFDLENBQUM7aUJBQ0QsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFNLEVBQUUsRUFBRTtnQkFDdEI7OzttQkFHRztnQkFDSCxJQUFJLENBQUMsQ0FBQyxTQUFTLElBQUksQ0FBQyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEVBQUU7b0JBQzdDLFlBQVksQ0FBQyxNQUFNLENBQUMsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRTt3QkFDM0MsT0FBTzt3QkFDUCxPQUFPO3dCQUNQLGVBQWU7cUJBQ2hCLENBQUMsQ0FBQTtpQkFDSDtnQkFDRCxpQ0FBaUM7Z0JBQ2pDLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQTtZQUMxQixDQUFDLENBQUMsQ0FBQTtRQUNOLENBQUMsQ0FBQTtRQUNELE9BQU8sTUFBTSxDQUFBO0lBQ2YsQ0FBQztBQUNILENBQUM7QUEzREQsZ0NBMkRDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX2NsaWVudF9zdXBwbGllci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9rbXNfY2xpZW50X3N1cHBsaWVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQSxvRUFBb0U7QUFDcEUsc0NBQXNDOzs7QUFFdEMseUVBQXVEO0FBdUJ2RCxTQUFnQixTQUFTLENBQ3ZCLFNBQTJDLEVBQzNDLGFBQXNCO0lBRXRCLE9BQU8sU0FBUyxZQUFZLENBQUMsTUFBYztRQUN6Qzs7O1dBR0c7UUFDSCxNQUFNLE1BQU0sR0FBRyxDQUFDLE1BQU07WUFDcEIsQ0FBQyxDQUFDLEVBQUUsR0FBRyxhQUFhLEVBQUUsTUFBTSxFQUFFO1lBQzlCLENBQUMsQ0FBQyxFQUFFLEdBQUcsYUFBYSxFQUFFLENBQVcsQ0FBQTtRQUNuQyxNQUFNLE1BQU0sR0FBRyxJQUFJLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtRQUVwQzs7OztXQUlHO1FBQ0gsOEZBQThGO1FBQzlGLDJCQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsc0JBQXNCLENBQUMsQ0FBQTtRQUNuRCxPQUFPLE1BQU0sQ0FBQTtJQUNmLENBQUMsQ0FBQTtBQUNILENBQUM7QUF2QkQsOEJBdUJDO0FBRUQsU0FBZ0IsWUFBWSxDQUMxQixPQUFpQixFQUNqQixTQUFvQztJQUVwQyxrRUFBa0U7SUFDbEUsMkJBQUssQ0FDSCxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLFFBQVEsQ0FBQyxFQUNsRCxrQ0FBa0MsQ0FDbkMsQ0FBQTtJQUVELE9BQU8sQ0FBQyxNQUFjLEVBQUUsRUFBRTtRQUN4QixJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQTtRQUMzQyxPQUFPLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUMxQixDQUFDLENBQUE7QUFDSCxDQUFDO0FBZEQsb0NBY0M7QUFFRCxTQUFnQixjQUFjLENBQzVCLE9BQWlCLEVBQ2pCLFNBQW9DO0lBRXBDLCtEQUErRDtJQUMvRCwyQkFBSyxDQUNILE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLEtBQUssUUFBUSxDQUFDLEVBQ2xELG9DQUFvQyxDQUNyQyxDQUFBO0lBRUQsT0FBTyxDQUFDLE1BQWMsRUFBRSxFQUFFO1FBQ3hCLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQTtRQUMxQyxPQUFPLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUMxQixDQUFDLENBQUE7QUFDSCxDQUFDO0FBZEQsd0NBY0M7QUFFRCxTQUFnQixZQUFZLENBQzFCLFNBQW9DO0lBRXBDLE1BQU0sWUFBWSxHQUFzQyxFQUFFLENBQUE7SUFFMUQsT0FBTyxDQUFDLE1BQWMsRUFBRSxFQUFFO1FBQ3hCLGdFQUFnRTtRQUNoRSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxNQUFNLENBQUM7WUFDN0QsT0FBTyxVQUFVLENBQUMsWUFBWSxFQUFFLE1BQU0sRUFBRSxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQTtRQUM1RCxPQUFPLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUM3QixDQUFDLENBQUE7QUFDSCxDQUFDO0FBWEQsb0NBV0M7QUFFRDs7Ozs7O0dBTUc7QUFDSCxTQUFnQixVQUFVLENBQ3hCLFlBQStDLEVBQy9DLE1BQWMsRUFDZCxNQUFzQjtJQUV0Qix3RkFBd0Y7SUFDeEYsSUFBSSxDQUFDLE1BQU0sRUFBRTtRQUNYLFlBQVksQ0FBQyxNQUFNLENBQUMsR0FBRyxLQUFLLENBQUE7UUFDNUIsT0FBTyxLQUFLLENBQUE7S0FDYjtJQUNELE1BQU0sRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLGVBQWUsRUFBRSxHQUFHLE1BQU0sQ0FBQTtJQUVwRCxPQUFRO1FBQ04sU0FBUztRQUNULFNBQVM7UUFDVCxpQkFBaUI7S0FDZ0IsQ0FBQyxNQUFNLENBQUMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBRWpFLGlFQUFpRTtJQUNqRSxTQUFTLGFBQWEsQ0FDcEIsTUFBYyxFQUNkLElBQStCO1FBRS9CLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQTtRQUM3QixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxVQUFVLGdCQUFnQixDQUU1QyxJQUFTO1lBRVQsOERBQThEO1lBQzlELE1BQU0sY0FBYyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFBO1lBQ2xELE1BQU0sYUFBYSxHQUNqQixTQUFTLElBQUksY0FBYyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQTtZQUN6RSxPQUFPLGFBQWE7aUJBQ2pCLElBQUksQ0FBQyxDQUFDLFFBQWEsRUFBRSxFQUFFO2dCQUN0QixZQUFZLENBQUMsTUFBTSxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUU7b0JBQzNDLE9BQU87b0JBQ1AsT0FBTztvQkFDUCxlQUFlO2lCQUNoQixDQUFDLENBQUE7Z0JBQ0YsT0FBTyxRQUFRLENBQUE7WUFDakIsQ0FBQyxDQUFDO2lCQUNELEtBQUssQ0FBQyxLQUFLLEVBQUUsQ0FBTSxFQUFFLEVBQUU7Z0JBQ3RCOzs7bUJBR0c7Z0JBQ0gsSUFBSSxDQUFDLENBQUMsU0FBUyxJQUFJLENBQUMsQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFO29CQUM3QyxZQUFZLENBQUMsTUFBTSxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUU7d0JBQzNDLE9BQU87d0JBQ1AsT0FBTzt3QkFDUCxlQUFlO3FCQUNoQixDQUFDLENBQUE7aUJBQ0g7Z0JBQ0QsaUNBQWlDO2dCQUNqQyxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUE7WUFDMUIsQ0FBQyxDQUFDLENBQUE7UUFDTixDQUFDLENBQUE7UUFDRCxPQUFPLE1BQU0sQ0FBQTtJQUNmLENBQUM7QUFDSCxDQUFDO0FBM0RELGdDQTJEQyJ9

build/main/kms_keyring.d.ts

@@ -10,2 +10,6 @@ import { KmsClientSupplier } from './kms_client_supplier';
     discovery?: boolean;
+    discoveryFilter?: {
+        accountIDs: string[];
+        partition: string;
+    };
 }
@@ -18,2 +22,6 @@ export interface KeyRing<S extends SupportedAlgorithmSuites, Client extends AwsEsdkKMSInterface> extends Keyring<S> {
     isDiscovery: boolean;
+    discoveryFilter?: Readonly<{
+        accountIDs: readonly string[];
+        partition: string;
+    }>;
     _onEncrypt(material: EncryptionMaterial<S>): Promise<EncryptionMaterial<S>>;
@@ -20,0 +28,0 @@ _onDecrypt(material: DecryptionMaterial<S>, encryptedDataKeys: EncryptedDataKey[]): Promise<DecryptionMaterial<S>>;

build/main/kms_keyring.js

@@ -5,2 +5,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.KmsKeyringClass = void 0;
 const material_management_1 = require("@aws-crypto/material-management");
@@ -11,3 +12,3 @@ const helpers_1 = require("./helpers");
     class KmsKeyring extends BaseKeyring {
-        constructor({ clientProvider, generatorKeyId, keyIds = [], grantTokens, discovery, }) {
+        constructor({ clientProvider, generatorKeyId, keyIds = [], grantTokens, discovery, discoveryFilter, }) {
             super();
@@ -20,2 +21,14 @@ /* Precondition: This is an abstract class. (But TypeScript does not have a clean way to model this) */
             material_management_1.needs(!(discovery && (generatorKeyId || keyIds.length)), 'A keyring can be either a Discovery or have keyIds configured.');
+            /* Precondition: Discovery filter can only be configured in discovery mode. */
+            material_management_1.needs(discovery || (!discovery && !discoveryFilter), 'Account and partition decrypt filtering are only supported when discovery === true');
+            /* Precondition: A Discovery filter *must* be able to match something.
+             * I am not going to wait to tell you
+             * that no CMK can match an empty account list.
+             * e.g. [], [''], '' are not valid.
+             */
+            material_management_1.needs(!discoveryFilter ||
+                (discoveryFilter.accountIDs &&
+                    discoveryFilter.accountIDs.length &&
+                    !!discoveryFilter.partition &&
+                    discoveryFilter.accountIDs.every((a) => typeof a === 'string' && !!a)), 'A discovery filter must be able to match something.');
             /* Precondition: All KMS key identifiers must be valid. */
@@ -32,2 +45,8 @@ material_management_1.needs(!generatorKeyId ||
             material_management_1.readOnlyProperty(this, 'isDiscovery', !!discovery);
+            material_management_1.readOnlyProperty(this, 'discoveryFilter', discoveryFilter
+                ? Object.freeze({
+                    ...discoveryFilter,
+                    accountIDs: Object.freeze(discoveryFilter.accountIDs),
+                })
+                : discoveryFilter);
         }
@@ -95,10 +114,3 @@ /* Keyrings *must* preserve the order of EDK's.  The generatorKeyId is the first on this list. */
              */
-            const decryptableEDKs = encryptedDataKeys.filter(({ providerId, providerInfo }) => {
-                if (providerId !== helpers_1.KMS_PROVIDER_ID)
-                    return false;
-                /* Discovery keyrings can not have keyIds configured,
-                 * and non-discovery keyrings must have keyIds configured.
-                 */
-                return this.isDiscovery || keyIds.includes(providerInfo);
-            });
+            const decryptableEDKs = encryptedDataKeys.filter(filterEDKs(keyIds, this));
             const cmkErrors = [];
@@ -153,2 +165,39 @@ for (const edk of decryptableEDKs) {
 exports.KmsKeyringClass = KmsKeyringClass;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX2tleXJpbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMva21zX2tleXJpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7O0FBSXRDLHlFQVl3QztBQUN4Qyx1Q0FNa0I7QUFDbEIsdUVBQStEO0FBcUMvRCxTQUFnQixlQUFlLENBRzdCLFdBQW9DO0lBQ3BDLE1BQU0sVUFBVyxTQUFRLFdBQVc7UUFPbEMsWUFBWSxFQUNWLGNBQWMsRUFDZCxjQUFjLEVBQ2QsTUFBTSxHQUFHLEVBQUUsRUFDWCxXQUFXLEVBQ1gsU0FBUyxHQUNlO1lBQ3hCLEtBQUssRUFBRSxDQUFBO1lBQ1AsdUdBQXVHO1lBQ3ZHLDJCQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsS0FBSyxVQUFVLEVBQUUsK0JBQStCLENBQUMsQ0FBQTtZQUN2RSxxREFBcUQ7WUFDckQsMkJBQUssQ0FDSCxDQUFDLENBQUMsQ0FBQyxTQUFTLElBQUksQ0FBQyxjQUFjLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQ2xELHVEQUF1RCxDQUN4RCxDQUFBO1lBQ0Qsa0ZBQWtGO1lBQ2xGLDJCQUFLLENBQ0gsQ0FBQyxDQUFDLFNBQVMsSUFBSSxDQUFDLGNBQWMsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsRUFDakQsZ0VBQWdFLENBQ2pFLENBQUE7WUFDRCwwREFBMEQ7WUFDMUQsMkJBQUssQ0FDSCxDQUFDLGNBQWM7Z0JBQ2IsT0FBTyw2Q0FBbUIsQ0FBQyxjQUFjLENBQUMsS0FBSyxRQUFRLEVBQ3pELGdCQUFnQixDQUNqQixDQUFBO1lBQ0QsMkJBQUssQ0FDSCxNQUFNLENBQUMsS0FBSyxDQUNWLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxPQUFPLDZDQUFtQixDQUFDLE1BQU0sQ0FBQyxLQUFLLFFBQVEsQ0FDNUQsRUFDRCxnQkFBZ0IsQ0FDakIsQ0FBQTtZQUNELG1FQUFtRTtZQUNuRSwyQkFBSyxDQUFDLE9BQU8sY0FBYyxLQUFLLFVBQVUsRUFBRSx3QkFBd0IsQ0FBQyxDQUFBO1lBRXJFLHNDQUFnQixDQUFDLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxjQUFjLENBQUMsQ0FBQTtZQUN4RCxzQ0FBZ0IsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQTtZQUMvRCxzQ0FBZ0IsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxDQUFDLENBQUE7WUFDeEQsc0NBQWdCLENBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRSxXQUFXLENBQUMsQ0FBQTtZQUNsRCxzQ0FBZ0IsQ0FBQyxJQUFJLEVBQUUsYUFBYSxFQUFFLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQTtRQUNwRCxDQUFDO1FBRUQsaUdBQWlHO1FBQ2pHLEtBQUssQ0FBQyxVQUFVLENBQUMsUUFBK0I7WUFDOUMsZ0ZBQWdGO1lBQ2hGLElBQUksSUFBSSxDQUFDLFdBQVc7Z0JBQUUsT0FBTyxRQUFRLENBQUE7WUFFckMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQTtZQUNsQyxNQUFNLEVBQUUsY0FBYyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFJLENBQUE7WUFDNUQsSUFBSSxjQUFjLElBQUksQ0FBQyxRQUFRLENBQUMscUJBQXFCLEVBQUU7Z0JBQ3JELE1BQU0sT0FBTyxHQUFHLE1BQU0seUJBQWUsQ0FDbkMsY0FBYyxFQUNkLFFBQVEsQ0FBQyxLQUFLLENBQUMsY0FBYyxFQUM3QixjQUFjLEVBQ2QsUUFBUSxDQUFDLGlCQUFpQixFQUMxQixXQUFXLENBQ1osQ0FBQTtnQkFDRDs7OzttQkFJRztnQkFDSCxJQUFJLENBQUMsT0FBTztvQkFDVixNQUFNLElBQUksS0FBSyxDQUFDLCtDQUErQyxDQUFDLENBQUE7Z0JBRWxFLE1BQU0sS0FBSyxHQUNULHNDQUFnQixDQUFDLCtCQUErQjtvQkFDaEQsc0NBQWdCLENBQUMsMkJBQTJCO29CQUM1QyxzQ0FBZ0IsQ0FBQywrQkFBK0IsQ0FBQTtnQkFDbEQsTUFBTSxLQUFLLEdBQWlCO29CQUMxQixZQUFZLEVBQUUseUJBQWU7b0JBQzdCLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSztvQkFDdEIsS0FBSztpQkFDTixDQUFBO2dCQUVELFFBQVE7b0JBQ047O3VCQUVHO3FCQUNGLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDO3FCQUMvQyxtQkFBbUIsQ0FDbEIsdUNBQTZCLENBQUMsT0FBTyxDQUFDLEVBQ3RDLHNDQUFnQixDQUFDLCtCQUErQjtvQkFDOUMsc0NBQWdCLENBQUMsMkJBQTJCLENBQy9DLENBQUE7YUFDSjtpQkFBTSxJQUFJLGNBQWMsRUFBRTtnQkFDekIsTUFBTSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQTthQUMvQjtZQUVEOzs7ZUFHRztZQUNILE1BQU0sa0JBQWtCLEdBQUcsbUNBQWEsQ0FBQyxRQUFRLENBQUMscUJBQXFCLEVBQUUsQ0FBQyxDQUFBO1lBRTFFLE1BQU0sS0FBSyxHQUNULHNDQUFnQixDQUFDLCtCQUErQjtnQkFDaEQsc0NBQWdCLENBQUMsMkJBQTJCLENBQUE7WUFDOUMsS0FBSyxNQUFNLE1BQU0sSUFBSSxNQUFNLEVBQUU7Z0JBQzNCLE1BQU0sTUFBTSxHQUFHLE1BQU0saUJBQU8sQ0FDMUIsY0FBYyxFQUNkLGtCQUFrQixFQUNsQixNQUFNLEVBQ04sUUFBUSxDQUFDLGlCQUFpQixFQUMxQixXQUFXLENBQ1osQ0FBQTtnQkFFRCxxRkFBcUY7Z0JBQ3JGLElBQUksTUFBTTtvQkFDUixRQUFRLENBQUMsbUJBQW1CLENBQzFCLHVDQUE2QixDQUFDLE1BQU0sQ0FBQyxFQUNyQyxLQUFLLENBQ04sQ0FBQTthQUNKO1lBRUQsT0FBTyxRQUFRLENBQUE7UUFDakIsQ0FBQztRQUVELEtBQUssQ0FBQyxVQUFVLENBQ2QsUUFBK0IsRUFDL0IsaUJBQXFDO1lBRXJDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUE7WUFDbEMsTUFBTSxFQUFFLGNBQWMsRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLEdBQUcsSUFBSSxDQUFBO1lBQzVELElBQUksY0FBYztnQkFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFBO1lBRWxEOzs7OztlQUtHO1lBQ0gsTUFBTSxlQUFlLEdBQUcsaUJBQWlCLENBQUMsTUFBTSxDQUM5QyxDQUFDLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxFQUFFLEVBQUU7Z0JBQy9CLElBQUksVUFBVSxLQUFLLHlCQUFlO29CQUFFLE9BQU8sS0FBSyxDQUFBO2dCQUNoRDs7bUJBRUc7Z0JBQ0gsT0FBTyxJQUFJLENBQUMsV0FBVyxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUE7WUFDMUQsQ0FBQyxDQUNGLENBQUE7WUFFRCxNQUFNLFNBQVMsR0FBWSxFQUFFLENBQUE7WUFFN0IsS0FBSyxNQUFNLEdBQUcsSUFBSSxlQUFlLEVBQUU7Z0JBQ2pDLElBQUksT0FBTyxHQUFvQyxLQUFLLENBQUE7Z0JBQ3BELElBQUk7b0JBQ0YsT0FBTyxHQUFHLE1BQU0saUJBQU8sQ0FDckIsY0FBYyxFQUNkLEdBQUcsRUFDSCxRQUFRLENBQUMsaUJBQWlCLEVBQzFCLFdBQVcsQ0FDWixDQUFBO2lCQUNGO2dCQUFDLE9BQU8sQ0FBQyxFQUFFO29CQUNWOzs7dUJBR0c7b0JBQ0gsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQTtpQkFDbEI7Z0JBRUQscUZBQXFGO2dCQUNyRixJQUFJLENBQUMsT0FBTztvQkFBRSxTQUFRO2dCQUV0QixxRUFBcUU7Z0JBQ3JFLDJCQUFLLENBQ0gsT0FBTyxDQUFDLEtBQUssS0FBSyxHQUFHLENBQUMsWUFBWSxFQUNsQyx3REFBd0QsQ0FDekQsQ0FBQTtnQkFFRCxNQUFNLEtBQUssR0FDVCxzQ0FBZ0IsQ0FBQywrQkFBK0I7b0JBQ2hELHNDQUFnQixDQUFDLDZCQUE2QixDQUFBO2dCQUNoRCxNQUFNLEtBQUssR0FBaUI7b0JBQzFCLFlBQVksRUFBRSx5QkFBZTtvQkFDN0IsT0FBTyxFQUFFLE9BQU8sQ0FBQyxLQUFLO29CQUN0QixLQUFLO2lCQUNOLENBQUE7Z0JBRUQ7O21CQUVHO2dCQUNILFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxDQUFBO2dCQUN4RCxPQUFPLFFBQVEsQ0FBQTthQUNoQjtZQUVEOzs7Ozs7OztlQVFHO1lBQ0gsMkJBQUssQ0FDSCxRQUFRLENBQUMsV0FBVyxFQUFFO2dCQUNwQixDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUNoRCxTQUFTLENBQUMsTUFBTSxDQUNkLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQUssS0FBSyxFQUNwRCx1RUFBdUUsQ0FDeEUsQ0FDRixDQUFBO1lBRUQsT0FBTyxRQUFRLENBQUE7UUFDakIsQ0FBQztLQUNGO0lBQ0Qsb0NBQWMsQ0FBQyxVQUFVLENBQUMsQ0FBQTtJQUMxQixPQUFPLFVBQVUsQ0FBQTtBQUNuQixDQUFDO0FBNU5ELDBDQTROQyJ9
+function filterEDKs(keyIds, { isDiscovery, discoveryFilter }) {
+    return function filter({ providerId, providerInfo }) {
+        /* Check for early return (Postcondition): Only AWS KMS EDK should be attempted. */
+        if (providerId !== helpers_1.KMS_PROVIDER_ID)
+            return false;
+        /* Discovery keyrings can not have keyIds configured,
+         * and non-discovery keyrings must have keyIds configured.
+         */
+        if (isDiscovery) {
+            /* Check for early return (Postcondition): There is no discoveryFilter to further condition discovery. */
+            if (!discoveryFilter)
+                return true;
+            /* If the providerInfo is an invalid ARN this will throw.
+             * But, this function is also used to extract regions
+             * from an CMK to generate a regional client.
+             * This means it will NOT throw for something
+             * that looks like a bare alias or key id.
+             * However, these constructions will not have an account or partition.
+             */
+            const { account, partition } = region_from_kms_key_arn_1.decomposeAwsKmsKeyArn(providerInfo);
+            /* Postcondition: The account and partition *must* match the discovery filter.
+             * Since we are offering a runtime discovery of CMKs
+             * it is best to have some form of filter on this.
+             * The providerInfo is a CMK ARN and will have the account and partition.
+             * By offering these levers customers can easily bound
+             * the CMKs to ones they control without knowing the CMKs
+             * when the AWS KMS Keyring is instantiated.
+             */
+            return (discoveryFilter.partition === partition &&
+                discoveryFilter.accountIDs.some((a) => a === account));
+        }
+        else {
+            /* Postcondition: The EDK CMK (providerInfo) *must* match a configured CMK. */
+            return keyIds.includes(providerInfo);
+        }
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX2tleXJpbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMva21zX2tleXJpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7OztBQUl0Qyx5RUFZd0M7QUFDeEMsdUNBTWtCO0FBQ2xCLHVFQUdrQztBQTZDbEMsU0FBZ0IsZUFBZSxDQUc3QixXQUFvQztJQUNwQyxNQUFNLFVBQVcsU0FBUSxXQUFXO1FBV2xDLFlBQVksRUFDVixjQUFjLEVBQ2QsY0FBYyxFQUNkLE1BQU0sR0FBRyxFQUFFLEVBQ1gsV0FBVyxFQUNYLFNBQVMsRUFDVCxlQUFlLEdBQ1M7WUFDeEIsS0FBSyxFQUFFLENBQUE7WUFDUCx1R0FBdUc7WUFDdkcsMkJBQUssQ0FBQyxJQUFJLENBQUMsV0FBVyxLQUFLLFVBQVUsRUFBRSwrQkFBK0IsQ0FBQyxDQUFBO1lBQ3ZFLHFEQUFxRDtZQUNyRCwyQkFBSyxDQUNILENBQUMsQ0FBQyxDQUFDLFNBQVMsSUFBSSxDQUFDLGNBQWMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFDbEQsdURBQXVELENBQ3hELENBQUE7WUFDRCxrRkFBa0Y7WUFDbEYsMkJBQUssQ0FDSCxDQUFDLENBQUMsU0FBUyxJQUFJLENBQUMsY0FBYyxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUNqRCxnRUFBZ0UsQ0FDakUsQ0FBQTtZQUNELDhFQUE4RTtZQUM5RSwyQkFBSyxDQUNILFNBQVMsSUFBSSxDQUFDLENBQUMsU0FBUyxJQUFJLENBQUMsZUFBZSxDQUFDLEVBQzdDLG9GQUFvRixDQUNyRixDQUFBO1lBQ0Q7Ozs7ZUFJRztZQUNILDJCQUFLLENBQ0gsQ0FBQyxlQUFlO2dCQUNkLENBQUMsZUFBZSxDQUFDLFVBQVU7b0JBQ3pCLGVBQWUsQ0FBQyxVQUFVLENBQUMsTUFBTTtvQkFDakMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxTQUFTO29CQUMzQixlQUFlLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FDOUIsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUNwQyxDQUFDLEVBQ04scURBQXFELENBQ3RELENBQUE7WUFFRCwwREFBMEQ7WUFDMUQsMkJBQUssQ0FDSCxDQUFDLGNBQWM7Z0JBQ2IsT0FBTyw2Q0FBbUIsQ0FBQyxjQUFjLENBQUMsS0FBSyxRQUFRLEVBQ3pELGdCQUFnQixDQUNqQixDQUFBO1lBQ0QsMkJBQUssQ0FDSCxNQUFNLENBQUMsS0FBSyxDQUNWLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxPQUFPLDZDQUFtQixDQUFDLE1BQU0sQ0FBQyxLQUFLLFFBQVEsQ0FDNUQsRUFDRCxnQkFBZ0IsQ0FDakIsQ0FBQTtZQUNELG1FQUFtRTtZQUNuRSwyQkFBSyxDQUFDLE9BQU8sY0FBYyxLQUFLLFVBQVUsRUFBRSx3QkFBd0IsQ0FBQyxDQUFBO1lBRXJFLHNDQUFnQixDQUFDLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxjQUFjLENBQUMsQ0FBQTtZQUN4RCxzQ0FBZ0IsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQTtZQUMvRCxzQ0FBZ0IsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxDQUFDLENBQUE7WUFDeEQsc0NBQWdCLENBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRSxXQUFXLENBQUMsQ0FBQTtZQUNsRCxzQ0FBZ0IsQ0FBQyxJQUFJLEVBQUUsYUFBYSxFQUFFLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQTtZQUNsRCxzQ0FBZ0IsQ0FDZCxJQUFJLEVBQ0osaUJBQWlCLEVBQ2pCLGVBQWU7Z0JBQ2IsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7b0JBQ1osR0FBRyxlQUFlO29CQUNsQixVQUFVLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDO2lCQUN0RCxDQUFDO2dCQUNKLENBQUMsQ0FBQyxlQUFlLENBQ3BCLENBQUE7UUFDSCxDQUFDO1FBRUQsaUdBQWlHO1FBQ2pHLEtBQUssQ0FBQyxVQUFVLENBQUMsUUFBK0I7WUFDOUMsZ0ZBQWdGO1lBQ2hGLElBQUksSUFBSSxDQUFDLFdBQVc7Z0JBQUUsT0FBTyxRQUFRLENBQUE7WUFFckMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQTtZQUNsQyxNQUFNLEVBQUUsY0FBYyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFJLENBQUE7WUFDNUQsSUFBSSxjQUFjLElBQUksQ0FBQyxRQUFRLENBQUMscUJBQXFCLEVBQUU7Z0JBQ3JELE1BQU0sT0FBTyxHQUFHLE1BQU0seUJBQWUsQ0FDbkMsY0FBYyxFQUNkLFFBQVEsQ0FBQyxLQUFLLENBQUMsY0FBYyxFQUM3QixjQUFjLEVBQ2QsUUFBUSxDQUFDLGlCQUFpQixFQUMxQixXQUFXLENBQ1osQ0FBQTtnQkFDRDs7OzttQkFJRztnQkFDSCxJQUFJLENBQUMsT0FBTztvQkFDVixNQUFNLElBQUksS0FBSyxDQUFDLCtDQUErQyxDQUFDLENBQUE7Z0JBRWxFLE1BQU0sS0FBSyxHQUNULHNDQUFnQixDQUFDLCtCQUErQjtvQkFDaEQsc0NBQWdCLENBQUMsMkJBQTJCO29CQUM1QyxzQ0FBZ0IsQ0FBQywrQkFBK0IsQ0FBQTtnQkFDbEQsTUFBTSxLQUFLLEdBQWlCO29CQUMxQixZQUFZLEVBQUUseUJBQWU7b0JBQzdCLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSztvQkFDdEIsS0FBSztpQkFDTixDQUFBO2dCQUVELFFBQVE7b0JBQ047O3VCQUVHO3FCQUNGLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDO3FCQUMvQyxtQkFBbUIsQ0FDbEIsdUNBQTZCLENBQUMsT0FBTyxDQUFDLEVBQ3RDLHNDQUFnQixDQUFDLCtCQUErQjtvQkFDOUMsc0NBQWdCLENBQUMsMkJBQTJCLENBQy9DLENBQUE7YUFDSjtpQkFBTSxJQUFJLGNBQWMsRUFBRTtnQkFDekIsTUFBTSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQTthQUMvQjtZQUVEOzs7ZUFHRztZQUNILE1BQU0sa0JBQWtCLEdBQUcsbUNBQWEsQ0FBQyxRQUFRLENBQUMscUJBQXFCLEVBQUUsQ0FBQyxDQUFBO1lBRTFFLE1BQU0sS0FBSyxHQUNULHNDQUFnQixDQUFDLCtCQUErQjtnQkFDaEQsc0NBQWdCLENBQUMsMkJBQTJCLENBQUE7WUFDOUMsS0FBSyxNQUFNLE1BQU0sSUFBSSxNQUFNLEVBQUU7Z0JBQzNCLE1BQU0sTUFBTSxHQUFHLE1BQU0saUJBQU8sQ0FDMUIsY0FBYyxFQUNkLGtCQUFrQixFQUNsQixNQUFNLEVBQ04sUUFBUSxDQUFDLGlCQUFpQixFQUMxQixXQUFXLENBQ1osQ0FBQTtnQkFFRCxxRkFBcUY7Z0JBQ3JGLElBQUksTUFBTTtvQkFDUixRQUFRLENBQUMsbUJBQW1CLENBQzFCLHVDQUE2QixDQUFDLE1BQU0sQ0FBQyxFQUNyQyxLQUFLLENBQ04sQ0FBQTthQUNKO1lBRUQsT0FBTyxRQUFRLENBQUE7UUFDakIsQ0FBQztRQUVELEtBQUssQ0FBQyxVQUFVLENBQ2QsUUFBK0IsRUFDL0IsaUJBQXFDO1lBRXJDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUE7WUFDbEMsTUFBTSxFQUFFLGNBQWMsRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLEdBQUcsSUFBSSxDQUFBO1lBQzVELElBQUksY0FBYztnQkFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFBO1lBRWxEOzs7OztlQUtHO1lBQ0gsTUFBTSxlQUFlLEdBQUcsaUJBQWlCLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQTtZQUUxRSxNQUFNLFNBQVMsR0FBWSxFQUFFLENBQUE7WUFFN0IsS0FBSyxNQUFNLEdBQUcsSUFBSSxlQUFlLEVBQUU7Z0JBQ2pDLElBQUksT0FBTyxHQUFvQyxLQUFLLENBQUE7Z0JBQ3BELElBQUk7b0JBQ0YsT0FBTyxHQUFHLE1BQU0saUJBQU8sQ0FDckIsY0FBYyxFQUNkLEdBQUcsRUFDSCxRQUFRLENBQUMsaUJBQWlCLEVBQzFCLFdBQVcsQ0FDWixDQUFBO2lCQUNGO2dCQUFDLE9BQU8sQ0FBQyxFQUFFO29CQUNWOzs7dUJBR0c7b0JBQ0gsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQTtpQkFDbEI7Z0JBRUQscUZBQXFGO2dCQUNyRixJQUFJLENBQUMsT0FBTztvQkFBRSxTQUFRO2dCQUV0QixxRUFBcUU7Z0JBQ3JFLDJCQUFLLENBQ0gsT0FBTyxDQUFDLEtBQUssS0FBSyxHQUFHLENBQUMsWUFBWSxFQUNsQyx3REFBd0QsQ0FDekQsQ0FBQTtnQkFFRCxNQUFNLEtBQUssR0FDVCxzQ0FBZ0IsQ0FBQywrQkFBK0I7b0JBQ2hELHNDQUFnQixDQUFDLDZCQUE2QixDQUFBO2dCQUNoRCxNQUFNLEtBQUssR0FBaUI7b0JBQzFCLFlBQVksRUFBRSx5QkFBZTtvQkFDN0IsT0FBTyxFQUFFLE9BQU8sQ0FBQyxLQUFLO29CQUN0QixLQUFLO2lCQUNOLENBQUE7Z0JBRUQ7O21CQUVHO2dCQUNILFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxDQUFBO2dCQUN4RCxPQUFPLFFBQVEsQ0FBQTthQUNoQjtZQUVEOzs7Ozs7OztlQVFHO1lBQ0gsMkJBQUssQ0FDSCxRQUFRLENBQUMsV0FBVyxFQUFFO2dCQUNwQixDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUNoRCxTQUFTLENBQUMsTUFBTSxDQUNkLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQUssS0FBSyxFQUNwRCx1RUFBdUUsQ0FDeEUsQ0FDRixDQUFBO1lBRUQsT0FBTyxRQUFRLENBQUE7UUFDakIsQ0FBQztLQUNGO0lBQ0Qsb0NBQWMsQ0FBQyxVQUFVLENBQUMsQ0FBQTtJQUMxQixPQUFPLFVBQVUsQ0FBQTtBQUNuQixDQUFDO0FBeFBELDBDQXdQQztBQUVELFNBQVMsVUFBVSxDQUdqQixNQUFnQixFQUFFLEVBQUUsV0FBVyxFQUFFLGVBQWUsRUFBc0I7SUFDdEUsT0FBTyxTQUFTLE1BQU0sQ0FBQyxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQW9CO1FBQ25FLG1GQUFtRjtRQUNuRixJQUFJLFVBQVUsS0FBSyx5QkFBZTtZQUFFLE9BQU8sS0FBSyxDQUFBO1FBQ2hEOztXQUVHO1FBQ0gsSUFBSSxXQUFXLEVBQUU7WUFDZix5R0FBeUc7WUFDekcsSUFBSSxDQUFDLGVBQWU7Z0JBQUUsT0FBTyxJQUFJLENBQUE7WUFFakM7Ozs7OztlQU1HO1lBQ0gsTUFBTSxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsR0FBRywrQ0FBcUIsQ0FBQyxZQUFZLENBQUMsQ0FBQTtZQUNsRTs7Ozs7OztlQU9HO1lBQ0gsT0FBTyxDQUNMLGVBQWUsQ0FBQyxTQUFTLEtBQUssU0FBUztnQkFDdkMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxPQUFPLENBQUMsQ0FDdEQsQ0FBQTtTQUNGO2FBQU07WUFDTCw4RUFBOEU7WUFDOUUsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFBO1NBQ3JDO0lBQ0gsQ0FBQyxDQUFBO0FBQ0gsQ0FBQyJ9

build/main/kms_types.d.ts

 /// <reference types="node" />
 import { EncryptionContext } from '@aws-crypto/material-management';
 export interface DecryptRequest {
+    KeyId?: string;
     CiphertextBlob: Uint8Array;
@@ -5,0 +6,0 @@ EncryptionContext?: EncryptionContext;

build/main/region_from_kms_key_arn.d.ts

 export declare function regionFromKmsKeyArn(kmsKeyArn: string): string;
+export declare function decomposeAwsKmsKeyArn(kmsKeyArn: string): {
+    region: string;
+    account: string;
+    partition: string;
+};
 //# sourceMappingURL=region_from_kms_key_arn.d.ts.map

build/main/region_from_kms_key_arn.js

@@ -5,2 +5,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.decomposeAwsKmsKeyArn = exports.regionFromKmsKeyArn = void 0;
 const material_management_1 = require("@aws-crypto/material-management");
@@ -15,3 +16,9 @@ /* See: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-kms
 const aliasOrKeyResourceType = /^(alias|key)(\/.*)*$/;
+/* Maintaining function for backwards compatibility. */
 function regionFromKmsKeyArn(kmsKeyArn) {
+    const { region } = decomposeAwsKmsKeyArn(kmsKeyArn);
+    return region;
+}
+exports.regionFromKmsKeyArn = regionFromKmsKeyArn;
+function decomposeAwsKmsKeyArn(kmsKeyArn) {
     /* Precondition: A KMS key arn must be a string. */
@@ -23,3 +30,3 @@ material_management_1.needs(typeof kmsKeyArn === 'string', 'KMS key arn must be a string.');
      */
-    const [arnLiteral, partition, service, region = ''] = kmsKeyArn.split(':');
+    const [arnLiteral, partition, service, region = '', account = '',] = kmsKeyArn.split(':');
     /* Postcondition: The ARN must be well formed.
@@ -41,5 +48,5 @@ * The arn and kms section have defined values,
         (!service && !region && arnLiteral.match(aliasOrKeyResourceType)), 'Malformed arn.');
-    return region;
+    return { region, account, partition };
 }
-exports.regionFromKmsKeyArn = regionFromKmsKeyArn;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaW9uX2Zyb21fa21zX2tleV9hcm4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcmVnaW9uX2Zyb21fa21zX2tleV9hcm4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7O0FBRXRDLHlFQUF1RDtBQUV2RDs7Ozs7O0dBTUc7QUFDSCxNQUFNLHNCQUFzQixHQUFHLHNCQUFzQixDQUFBO0FBRXJELFNBQWdCLG1CQUFtQixDQUFDLFNBQWlCO0lBQ25ELG1EQUFtRDtJQUNuRCwyQkFBSyxDQUFDLE9BQU8sU0FBUyxLQUFLLFFBQVEsRUFBRSwrQkFBK0IsQ0FBQyxDQUFBO0lBRXJFOzs7T0FHRztJQUNILE1BQU0sQ0FBQyxVQUFVLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxNQUFNLEdBQUcsRUFBRSxDQUFDLEdBQUcsU0FBUyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUUxRTs7Ozs7OztPQU9HO0lBQ0gsMkJBQUssQ0FDSCxDQUFDLFVBQVUsS0FBSyxLQUFLLElBQUksU0FBUyxJQUFJLE9BQU8sS0FBSyxLQUFLLElBQUksTUFBTSxDQUFDO1FBQ2hFOzs7OztXQUtHO1FBQ0gsQ0FBQyxDQUFDLE9BQU8sSUFBSSxDQUFDLE1BQU0sSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDLENBQUMsRUFDbkUsZ0JBQWdCLENBQ2pCLENBQUE7SUFFRCxPQUFPLE1BQU0sQ0FBQTtBQUNmLENBQUM7QUEvQkQsa0RBK0JDIn0=
+exports.decomposeAwsKmsKeyArn = decomposeAwsKmsKeyArn;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaW9uX2Zyb21fa21zX2tleV9hcm4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcmVnaW9uX2Zyb21fa21zX2tleV9hcm4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7OztBQUV0Qyx5RUFBdUQ7QUFFdkQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxzQkFBc0IsR0FBRyxzQkFBc0IsQ0FBQTtBQUVyRCx1REFBdUQ7QUFDdkQsU0FBZ0IsbUJBQW1CLENBQUMsU0FBaUI7SUFDbkQsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLHFCQUFxQixDQUFDLFNBQVMsQ0FBQyxDQUFBO0lBQ25ELE9BQU8sTUFBTSxDQUFBO0FBQ2YsQ0FBQztBQUhELGtEQUdDO0FBRUQsU0FBZ0IscUJBQXFCLENBQ25DLFNBQWlCO0lBRWpCLG1EQUFtRDtJQUNuRCwyQkFBSyxDQUFDLE9BQU8sU0FBUyxLQUFLLFFBQVEsRUFBRSwrQkFBK0IsQ0FBQyxDQUFBO0lBRXJFOzs7T0FHRztJQUNILE1BQU0sQ0FDSixVQUFVLEVBQ1YsU0FBUyxFQUNULE9BQU8sRUFDUCxNQUFNLEdBQUcsRUFBRSxFQUNYLE9BQU8sR0FBRyxFQUFFLEVBQ2IsR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFBO0lBRXhCOzs7Ozs7O09BT0c7SUFDSCwyQkFBSyxDQUNILENBQUMsVUFBVSxLQUFLLEtBQUssSUFBSSxTQUFTLElBQUksT0FBTyxLQUFLLEtBQUssSUFBSSxNQUFNLENBQUM7UUFDaEU7Ozs7O1dBS0c7UUFDSCxDQUFDLENBQUMsT0FBTyxJQUFJLENBQUMsTUFBTSxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUMsc0JBQXNCLENBQUMsQ0FBQyxFQUNuRSxnQkFBZ0IsQ0FDakIsQ0FBQTtJQUVELE9BQU8sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxDQUFBO0FBQ3ZDLENBQUM7QUF2Q0Qsc0RBdUNDIn0=

build/module/helpers.js

@@ -46,3 +46,5 @@ // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
         return false;
+    /* The AWS KMS KeyId *must* be set. */
     const v2vsV3Response = client.decrypt({
+        KeyId: providerInfo,
         CiphertextBlob: encryptedDataKey,
@@ -96,2 +98,2 @@ EncryptionContext,
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9oZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7QUFZdEMsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sMkJBQTJCLENBQUE7QUFDL0QsT0FBTyxFQUVMLGdCQUFnQixFQUNoQixLQUFLLEdBQ04sTUFBTSxpQ0FBaUMsQ0FBQTtBQUV4QyxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsU0FBUyxDQUFBO0FBRXhDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsZUFBZSxDQUNuQyxjQUF5QyxFQUN6QyxhQUFxQixFQUNyQixLQUFhLEVBQ2IsaUJBQW9DLEVBQ3BDLFdBQXNCO0lBRXRCLE1BQU0sTUFBTSxHQUFHLG1CQUFtQixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ3pDLE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUVyQyx5R0FBeUc7SUFDekcsSUFBSSxDQUFDLE1BQU07UUFBRSxPQUFPLEtBQUssQ0FBQTtJQUN6QixNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsZUFBZSxDQUFDO1FBQzVDLEtBQUs7UUFDTCxXQUFXO1FBQ1gsYUFBYTtRQUNiLGlCQUFpQjtLQUNsQixDQUFDLENBQUE7SUFDRixNQUFNLGFBQWEsR0FDakIsU0FBUyxJQUFJLGNBQWMsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUE7SUFDekUsTUFBTSxPQUFPLEdBQUcsTUFBTSxhQUFhLENBQUE7SUFFbkMsT0FBTyxtQkFBbUIsQ0FBQyxPQUFPLENBQUMsQ0FBQTtBQUNyQyxDQUFDO0FBRUQsTUFBTSxDQUFDLEtBQUssVUFBVSxPQUFPLENBQzNCLGNBQXlDLEVBQ3pDLFNBQXFCLEVBQ3JCLEtBQWEsRUFDYixpQkFBb0MsRUFDcEMsV0FBc0I7SUFFdEIsTUFBTSxNQUFNLEdBQUcsbUJBQW1CLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDekMsTUFBTSxNQUFNLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBRXJDLGlHQUFpRztJQUNqRyxJQUFJLENBQUMsTUFBTTtRQUFFLE9BQU8sS0FBSyxDQUFBO0lBRXpCLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUM7UUFDcEMsS0FBSztRQUNMLFNBQVM7UUFDVCxpQkFBaUI7UUFDakIsV0FBVztLQUNaLENBQUMsQ0FBQTtJQUNGLE1BQU0sYUFBYSxHQUNqQixTQUFTLElBQUksY0FBYyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQTtJQUN6RSxNQUFNLE1BQU0sR0FBRyxNQUFNLGFBQWEsQ0FBQTtJQUVsQyxPQUFPLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxDQUFBO0FBQ2xDLENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLE9BQU8sQ0FDM0IsY0FBeUMsRUFDekMsRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFvQixFQUNoRSxpQkFBb0MsRUFDcEMsV0FBc0I7SUFFdEIsK0NBQStDO0lBQy9DLEtBQUssQ0FBQyxVQUFVLEtBQUssZUFBZSxFQUFFLHdCQUF3QixDQUFDLENBQUE7SUFDL0QsTUFBTSxNQUFNLEdBQUcsbUJBQW1CLENBQUMsWUFBWSxDQUFDLENBQUE7SUFDaEQsTUFBTSxNQUFNLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQ3JDLGlHQUFpRztJQUNqRyxJQUFJLENBQUMsTUFBTTtRQUFFLE9BQU8sS0FBSyxDQUFBO0lBRXpCLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUM7UUFDcEMsY0FBYyxFQUFFLGdCQUFnQjtRQUNoQyxpQkFBaUI7UUFDakIsV0FBVztLQUNaLENBQUMsQ0FBQTtJQUNGLE1BQU0sYUFBYSxHQUNqQixTQUFTLElBQUksY0FBYyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQTtJQUN6RSxNQUFNLE9BQU8sR0FBRyxNQUFNLGFBQWEsQ0FBQTtJQUVuQyxPQUFPLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxDQUFBO0FBQ25DLENBQUM7QUFFRCxNQUFNLFVBQVUsNkJBQTZCLENBQUMsRUFDNUMsS0FBSyxFQUFFLFlBQVksRUFDbkIsY0FBYyxFQUFFLGdCQUFnQixHQUNSO0lBQ3hCLE9BQU8sSUFBSSxnQkFBZ0IsQ0FBQztRQUMxQixVQUFVLEVBQUUsZUFBZTtRQUMzQixZQUFZO1FBQ1osZ0JBQWdCO0tBQ2pCLENBQUMsQ0FBQTtBQUNKLENBQUM7QUFFRCxTQUFTLG1CQUFtQixDQUMxQixPQUFnQztJQUVoQyxvRUFBb0U7SUFDcEUsS0FBSyxDQUNILE9BQU8sT0FBTyxDQUFDLEtBQUssS0FBSyxRQUFRO1FBQy9CLE9BQU8sQ0FBQyxTQUFTLFlBQVksVUFBVTtRQUN2QyxPQUFPLENBQUMsY0FBYyxZQUFZLFVBQVUsRUFDOUMseUJBQXlCLENBQzFCLENBQUE7SUFFRCxPQUFPLGFBQWEsQ0FDbEIsT0FBMEMsQ0FDUixDQUFBO0FBQ3RDLENBQUM7QUFFRCxTQUFTLGlCQUFpQixDQUFDLE9BQXdCO0lBQ2pELHFFQUFxRTtJQUNyRSxLQUFLLENBQ0gsT0FBTyxPQUFPLENBQUMsS0FBSyxLQUFLLFFBQVE7UUFDL0IsT0FBTyxDQUFDLGNBQWMsWUFBWSxVQUFVLEVBQzlDLHlCQUF5QixDQUMxQixDQUFBO0lBRUQsT0FBTyxPQUFrQyxDQUFBO0FBQzNDLENBQUM7QUFFRCxTQUFTLGlCQUFpQixDQUFDLE9BQXdCO0lBQ2pELDBEQUEwRDtJQUMxRCxLQUFLLENBQ0gsT0FBTyxPQUFPLENBQUMsS0FBSyxLQUFLLFFBQVE7UUFDL0IsT0FBTyxDQUFDLFNBQVMsWUFBWSxVQUFVLEVBQ3pDLHlCQUF5QixDQUMxQixDQUFBO0lBRUQsT0FBTyxhQUFhLENBQ2xCLE9BQWtDLENBQ1IsQ0FBQTtBQUM5QixDQUFDO0FBRUQsU0FBUyxhQUFhLENBQ3BCLE9BQWtFO0lBRWxFOzs7Ozs7O09BT0c7SUFDSCxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsT0FBTyxDQUFBO0lBQzdCLE9BQU8sQ0FBQyxTQUFTLEdBQUcsSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUE7SUFDN0MsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUNqQixPQUFPLE9BQU8sQ0FBQTtBQUNoQixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9oZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9FQUFvRTtBQUNwRSxzQ0FBc0M7QUFZdEMsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sMkJBQTJCLENBQUE7QUFDL0QsT0FBTyxFQUVMLGdCQUFnQixFQUNoQixLQUFLLEdBQ04sTUFBTSxpQ0FBaUMsQ0FBQTtBQUV4QyxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsU0FBUyxDQUFBO0FBRXhDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsZUFBZSxDQUNuQyxjQUF5QyxFQUN6QyxhQUFxQixFQUNyQixLQUFhLEVBQ2IsaUJBQW9DLEVBQ3BDLFdBQXNCO0lBRXRCLE1BQU0sTUFBTSxHQUFHLG1CQUFtQixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ3pDLE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUVyQyx5R0FBeUc7SUFDekcsSUFBSSxDQUFDLE1BQU07UUFBRSxPQUFPLEtBQUssQ0FBQTtJQUN6QixNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsZUFBZSxDQUFDO1FBQzVDLEtBQUs7UUFDTCxXQUFXO1FBQ1gsYUFBYTtRQUNiLGlCQUFpQjtLQUNsQixDQUFDLENBQUE7SUFDRixNQUFNLGFBQWEsR0FDakIsU0FBUyxJQUFJLGNBQWMsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUE7SUFDekUsTUFBTSxPQUFPLEdBQUcsTUFBTSxhQUFhLENBQUE7SUFFbkMsT0FBTyxtQkFBbUIsQ0FBQyxPQUFPLENBQUMsQ0FBQTtBQUNyQyxDQUFDO0FBRUQsTUFBTSxDQUFDLEtBQUssVUFBVSxPQUFPLENBQzNCLGNBQXlDLEVBQ3pDLFNBQXFCLEVBQ3JCLEtBQWEsRUFDYixpQkFBb0MsRUFDcEMsV0FBc0I7SUFFdEIsTUFBTSxNQUFNLEdBQUcsbUJBQW1CLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDekMsTUFBTSxNQUFNLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBRXJDLGlHQUFpRztJQUNqRyxJQUFJLENBQUMsTUFBTTtRQUFFLE9BQU8sS0FBSyxDQUFBO0lBRXpCLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUM7UUFDcEMsS0FBSztRQUNMLFNBQVM7UUFDVCxpQkFBaUI7UUFDakIsV0FBVztLQUNaLENBQUMsQ0FBQTtJQUNGLE1BQU0sYUFBYSxHQUNqQixTQUFTLElBQUksY0FBYyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQTtJQUN6RSxNQUFNLE1BQU0sR0FBRyxNQUFNLGFBQWEsQ0FBQTtJQUVsQyxPQUFPLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxDQUFBO0FBQ2xDLENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLE9BQU8sQ0FDM0IsY0FBeUMsRUFDekMsRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFvQixFQUNoRSxpQkFBb0MsRUFDcEMsV0FBc0I7SUFFdEIsK0NBQStDO0lBQy9DLEtBQUssQ0FBQyxVQUFVLEtBQUssZUFBZSxFQUFFLHdCQUF3QixDQUFDLENBQUE7SUFDL0QsTUFBTSxNQUFNLEdBQUcsbUJBQW1CLENBQUMsWUFBWSxDQUFDLENBQUE7SUFDaEQsTUFBTSxNQUFNLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQ3JDLGlHQUFpRztJQUNqRyxJQUFJLENBQUMsTUFBTTtRQUFFLE9BQU8sS0FBSyxDQUFBO0lBRXpCLHNDQUFzQztJQUN0QyxNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQ3BDLEtBQUssRUFBRSxZQUFZO1FBQ25CLGNBQWMsRUFBRSxnQkFBZ0I7UUFDaEMsaUJBQWlCO1FBQ2pCLFdBQVc7S0FDWixDQUFDLENBQUE7SUFDRixNQUFNLGFBQWEsR0FDakIsU0FBUyxJQUFJLGNBQWMsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUE7SUFDekUsTUFBTSxPQUFPLEdBQUcsTUFBTSxhQUFhLENBQUE7SUFFbkMsT0FBTyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsQ0FBQTtBQUNuQyxDQUFDO0FBRUQsTUFBTSxVQUFVLDZCQUE2QixDQUFDLEVBQzVDLEtBQUssRUFBRSxZQUFZLEVBQ25CLGNBQWMsRUFBRSxnQkFBZ0IsR0FDUjtJQUN4QixPQUFPLElBQUksZ0JBQWdCLENBQUM7UUFDMUIsVUFBVSxFQUFFLGVBQWU7UUFDM0IsWUFBWTtRQUNaLGdCQUFnQjtLQUNqQixDQUFDLENBQUE7QUFDSixDQUFDO0FBRUQsU0FBUyxtQkFBbUIsQ0FDMUIsT0FBZ0M7SUFFaEMsb0VBQW9FO0lBQ3BFLEtBQUssQ0FDSCxPQUFPLE9BQU8sQ0FBQyxLQUFLLEtBQUssUUFBUTtRQUMvQixPQUFPLENBQUMsU0FBUyxZQUFZLFVBQVU7UUFDdkMsT0FBTyxDQUFDLGNBQWMsWUFBWSxVQUFVLEVBQzlDLHlCQUF5QixDQUMxQixDQUFBO0lBRUQsT0FBTyxhQUFhLENBQ2xCLE9BQTBDLENBQ1IsQ0FBQTtBQUN0QyxDQUFDO0FBRUQsU0FBUyxpQkFBaUIsQ0FBQyxPQUF3QjtJQUNqRCxxRUFBcUU7SUFDckUsS0FBSyxDQUNILE9BQU8sT0FBTyxDQUFDLEtBQUssS0FBSyxRQUFRO1FBQy9CLE9BQU8sQ0FBQyxjQUFjLFlBQVksVUFBVSxFQUM5Qyx5QkFBeUIsQ0FDMUIsQ0FBQTtJQUVELE9BQU8sT0FBa0MsQ0FBQTtBQUMzQyxDQUFDO0FBRUQsU0FBUyxpQkFBaUIsQ0FBQyxPQUF3QjtJQUNqRCwwREFBMEQ7SUFDMUQsS0FBSyxDQUNILE9BQU8sT0FBTyxDQUFDLEtBQUssS0FBSyxRQUFRO1FBQy9CLE9BQU8sQ0FBQyxTQUFTLFlBQVksVUFBVSxFQUN6Qyx5QkFBeUIsQ0FDMUIsQ0FBQTtJQUVELE9BQU8sYUFBYSxDQUNsQixPQUFrQyxDQUNSLENBQUE7QUFDOUIsQ0FBQztBQUVELFNBQVMsYUFBYSxDQUNwQixPQUFrRTtJQUVsRTs7Ozs7OztPQU9HO0lBQ0gsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLE9BQU8sQ0FBQTtJQUM3QixPQUFPLENBQUMsU0FBUyxHQUFHLElBQUksVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFBO0lBQzdDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDakIsT0FBTyxPQUFPLENBQUE7QUFDaEIsQ0FBQyJ9

build/module/kms_keyring.d.ts

@@ -10,2 +10,6 @@ import { KmsClientSupplier } from './kms_client_supplier';
     discovery?: boolean;
+    discoveryFilter?: {
+        accountIDs: string[];
+        partition: string;
+    };
 }
@@ -18,2 +22,6 @@ export interface KeyRing<S extends SupportedAlgorithmSuites, Client extends AwsEsdkKMSInterface> extends Keyring<S> {
     isDiscovery: boolean;
+    discoveryFilter?: Readonly<{
+        accountIDs: readonly string[];
+        partition: string;
+    }>;
     _onEncrypt(material: EncryptionMaterial<S>): Promise<EncryptionMaterial<S>>;
@@ -20,0 +28,0 @@ _onDecrypt(material: DecryptionMaterial<S>, encryptedDataKeys: EncryptedDataKey[]): Promise<DecryptionMaterial<S>>;

build/module/kms_keyring.js

@@ -5,6 +5,6 @@ // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
 import { KMS_PROVIDER_ID, generateDataKey, encrypt, decrypt, kmsResponseToEncryptedDataKey, } from './helpers';
-import { regionFromKmsKeyArn } from './region_from_kms_key_arn';
+import { regionFromKmsKeyArn, decomposeAwsKmsKeyArn, } from './region_from_kms_key_arn';
 export function KmsKeyringClass(BaseKeyring) {
     class KmsKeyring extends BaseKeyring {
-        constructor({ clientProvider, generatorKeyId, keyIds = [], grantTokens, discovery, }) {
+        constructor({ clientProvider, generatorKeyId, keyIds = [], grantTokens, discovery, discoveryFilter, }) {
             super();
@@ -17,2 +17,14 @@ /* Precondition: This is an abstract class. (But TypeScript does not have a clean way to model this) */
             needs(!(discovery && (generatorKeyId || keyIds.length)), 'A keyring can be either a Discovery or have keyIds configured.');
+            /* Precondition: Discovery filter can only be configured in discovery mode. */
+            needs(discovery || (!discovery && !discoveryFilter), 'Account and partition decrypt filtering are only supported when discovery === true');
+            /* Precondition: A Discovery filter *must* be able to match something.
+             * I am not going to wait to tell you
+             * that no CMK can match an empty account list.
+             * e.g. [], [''], '' are not valid.
+             */
+            needs(!discoveryFilter ||
+                (discoveryFilter.accountIDs &&
+                    discoveryFilter.accountIDs.length &&
+                    !!discoveryFilter.partition &&
+                    discoveryFilter.accountIDs.every((a) => typeof a === 'string' && !!a)), 'A discovery filter must be able to match something.');
             /* Precondition: All KMS key identifiers must be valid. */
@@ -29,2 +41,8 @@ needs(!generatorKeyId ||
             readOnlyProperty(this, 'isDiscovery', !!discovery);
+            readOnlyProperty(this, 'discoveryFilter', discoveryFilter
+                ? Object.freeze({
+                    ...discoveryFilter,
+                    accountIDs: Object.freeze(discoveryFilter.accountIDs),
+                })
+                : discoveryFilter);
         }
@@ -92,10 +110,3 @@ /* Keyrings *must* preserve the order of EDK's.  The generatorKeyId is the first on this list. */
              */
-            const decryptableEDKs = encryptedDataKeys.filter(({ providerId, providerInfo }) => {
-                if (providerId !== KMS_PROVIDER_ID)
-                    return false;
-                /* Discovery keyrings can not have keyIds configured,
-                 * and non-discovery keyrings must have keyIds configured.
-                 */
-                return this.isDiscovery || keyIds.includes(providerInfo);
-            });
+            const decryptableEDKs = encryptedDataKeys.filter(filterEDKs(keyIds, this));
             const cmkErrors = [];
@@ -149,2 +160,39 @@ for (const edk of decryptableEDKs) {
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX2tleXJpbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMva21zX2tleXJpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0VBQW9FO0FBQ3BFLHNDQUFzQztBQUl0QyxPQUFPLEVBQ0wsS0FBSyxFQU1MLGdCQUFnQixFQUVoQixjQUFjLEVBQ2QsZ0JBQWdCLEVBQ2hCLGFBQWEsR0FDZCxNQUFNLGlDQUFpQyxDQUFBO0FBQ3hDLE9BQU8sRUFDTCxlQUFlLEVBQ2YsZUFBZSxFQUNmLE9BQU8sRUFDUCxPQUFPLEVBQ1AsNkJBQTZCLEdBQzlCLE1BQU0sV0FBVyxDQUFBO0FBQ2xCLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLDJCQUEyQixDQUFBO0FBcUMvRCxNQUFNLFVBQVUsZUFBZSxDQUc3QixXQUFvQztJQUNwQyxNQUFNLFVBQVcsU0FBUSxXQUFXO1FBT2xDLFlBQVksRUFDVixjQUFjLEVBQ2QsY0FBYyxFQUNkLE1BQU0sR0FBRyxFQUFFLEVBQ1gsV0FBVyxFQUNYLFNBQVMsR0FDZTtZQUN4QixLQUFLLEVBQUUsQ0FBQTtZQUNQLHVHQUF1RztZQUN2RyxLQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsS0FBSyxVQUFVLEVBQUUsK0JBQStCLENBQUMsQ0FBQTtZQUN2RSxxREFBcUQ7WUFDckQsS0FBSyxDQUNILENBQUMsQ0FBQyxDQUFDLFNBQVMsSUFBSSxDQUFDLGNBQWMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFDbEQsdURBQXVELENBQ3hELENBQUE7WUFDRCxrRkFBa0Y7WUFDbEYsS0FBSyxDQUNILENBQUMsQ0FBQyxTQUFTLElBQUksQ0FBQyxjQUFjLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQ2pELGdFQUFnRSxDQUNqRSxDQUFBO1lBQ0QsMERBQTBEO1lBQzFELEtBQUssQ0FDSCxDQUFDLGNBQWM7Z0JBQ2IsT0FBTyxtQkFBbUIsQ0FBQyxjQUFjLENBQUMsS0FBSyxRQUFRLEVBQ3pELGdCQUFnQixDQUNqQixDQUFBO1lBQ0QsS0FBSyxDQUNILE1BQU0sQ0FBQyxLQUFLLENBQ1YsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE9BQU8sbUJBQW1CLENBQUMsTUFBTSxDQUFDLEtBQUssUUFBUSxDQUM1RCxFQUNELGdCQUFnQixDQUNqQixDQUFBO1lBQ0QsbUVBQW1FO1lBQ25FLEtBQUssQ0FBQyxPQUFPLGNBQWMsS0FBSyxVQUFVLEVBQUUsd0JBQXdCLENBQUMsQ0FBQTtZQUVyRSxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxDQUFDLENBQUE7WUFDeEQsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUE7WUFDL0QsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLGdCQUFnQixFQUFFLGNBQWMsQ0FBQyxDQUFBO1lBQ3hELGdCQUFnQixDQUFDLElBQUksRUFBRSxhQUFhLEVBQUUsV0FBVyxDQUFDLENBQUE7WUFDbEQsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRSxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUE7UUFDcEQsQ0FBQztRQUVELGlHQUFpRztRQUNqRyxLQUFLLENBQUMsVUFBVSxDQUFDLFFBQStCO1lBQzlDLGdGQUFnRjtZQUNoRixJQUFJLElBQUksQ0FBQyxXQUFXO2dCQUFFLE9BQU8sUUFBUSxDQUFBO1lBRXJDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUE7WUFDbEMsTUFBTSxFQUFFLGNBQWMsRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLEdBQUcsSUFBSSxDQUFBO1lBQzVELElBQUksY0FBYyxJQUFJLENBQUMsUUFBUSxDQUFDLHFCQUFxQixFQUFFO2dCQUNyRCxNQUFNLE9BQU8sR0FBRyxNQUFNLGVBQWUsQ0FDbkMsY0FBYyxFQUNkLFFBQVEsQ0FBQyxLQUFLLENBQUMsY0FBYyxFQUM3QixjQUFjLEVBQ2QsUUFBUSxDQUFDLGlCQUFpQixFQUMxQixXQUFXLENBQ1osQ0FBQTtnQkFDRDs7OzttQkFJRztnQkFDSCxJQUFJLENBQUMsT0FBTztvQkFDVixNQUFNLElBQUksS0FBSyxDQUFDLCtDQUErQyxDQUFDLENBQUE7Z0JBRWxFLE1BQU0sS0FBSyxHQUNULGdCQUFnQixDQUFDLCtCQUErQjtvQkFDaEQsZ0JBQWdCLENBQUMsMkJBQTJCO29CQUM1QyxnQkFBZ0IsQ0FBQywrQkFBK0IsQ0FBQTtnQkFDbEQsTUFBTSxLQUFLLEdBQWlCO29CQUMxQixZQUFZLEVBQUUsZUFBZTtvQkFDN0IsT0FBTyxFQUFFLE9BQU8sQ0FBQyxLQUFLO29CQUN0QixLQUFLO2lCQUNOLENBQUE7Z0JBRUQsUUFBUTtvQkFDTjs7dUJBRUc7cUJBQ0YscUJBQXFCLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUM7cUJBQy9DLG1CQUFtQixDQUNsQiw2QkFBNkIsQ0FBQyxPQUFPLENBQUMsRUFDdEMsZ0JBQWdCLENBQUMsK0JBQStCO29CQUM5QyxnQkFBZ0IsQ0FBQywyQkFBMkIsQ0FDL0MsQ0FBQTthQUNKO2lCQUFNLElBQUksY0FBYyxFQUFFO2dCQUN6QixNQUFNLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFBO2FBQy9CO1lBRUQ7OztlQUdHO1lBQ0gsTUFBTSxrQkFBa0IsR0FBRyxhQUFhLENBQUMsUUFBUSxDQUFDLHFCQUFxQixFQUFFLENBQUMsQ0FBQTtZQUUxRSxNQUFNLEtBQUssR0FDVCxnQkFBZ0IsQ0FBQywrQkFBK0I7Z0JBQ2hELGdCQUFnQixDQUFDLDJCQUEyQixDQUFBO1lBQzlDLEtBQUssTUFBTSxNQUFNLElBQUksTUFBTSxFQUFFO2dCQUMzQixNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FDMUIsY0FBYyxFQUNkLGtCQUFrQixFQUNsQixNQUFNLEVBQ04sUUFBUSxDQUFDLGlCQUFpQixFQUMxQixXQUFXLENBQ1osQ0FBQTtnQkFFRCxxRkFBcUY7Z0JBQ3JGLElBQUksTUFBTTtvQkFDUixRQUFRLENBQUMsbUJBQW1CLENBQzFCLDZCQUE2QixDQUFDLE1BQU0sQ0FBQyxFQUNyQyxLQUFLLENBQ04sQ0FBQTthQUNKO1lBRUQsT0FBTyxRQUFRLENBQUE7UUFDakIsQ0FBQztRQUVELEtBQUssQ0FBQyxVQUFVLENBQ2QsUUFBK0IsRUFDL0IsaUJBQXFDO1lBRXJDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUE7WUFDbEMsTUFBTSxFQUFFLGNBQWMsRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLEdBQUcsSUFBSSxDQUFBO1lBQzVELElBQUksY0FBYztnQkFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFBO1lBRWxEOzs7OztlQUtHO1lBQ0gsTUFBTSxlQUFlLEdBQUcsaUJBQWlCLENBQUMsTUFBTSxDQUM5QyxDQUFDLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxFQUFFLEVBQUU7Z0JBQy9CLElBQUksVUFBVSxLQUFLLGVBQWU7b0JBQUUsT0FBTyxLQUFLLENBQUE7Z0JBQ2hEOzttQkFFRztnQkFDSCxPQUFPLElBQUksQ0FBQyxXQUFXLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQTtZQUMxRCxDQUFDLENBQ0YsQ0FBQTtZQUVELE1BQU0sU0FBUyxHQUFZLEVBQUUsQ0FBQTtZQUU3QixLQUFLLE1BQU0sR0FBRyxJQUFJLGVBQWUsRUFBRTtnQkFDakMsSUFBSSxPQUFPLEdBQW9DLEtBQUssQ0FBQTtnQkFDcEQsSUFBSTtvQkFDRixPQUFPLEdBQUcsTUFBTSxPQUFPLENBQ3JCLGNBQWMsRUFDZCxHQUFHLEVBQ0gsUUFBUSxDQUFDLGlCQUFpQixFQUMxQixXQUFXLENBQ1osQ0FBQTtpQkFDRjtnQkFBQyxPQUFPLENBQUMsRUFBRTtvQkFDVjs7O3VCQUdHO29CQUNILFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUE7aUJBQ2xCO2dCQUVELHFGQUFxRjtnQkFDckYsSUFBSSxDQUFDLE9BQU87b0JBQUUsU0FBUTtnQkFFdEIscUVBQXFFO2dCQUNyRSxLQUFLLENBQ0gsT0FBTyxDQUFDLEtBQUssS0FBSyxHQUFHLENBQUMsWUFBWSxFQUNsQyx3REFBd0QsQ0FDekQsQ0FBQTtnQkFFRCxNQUFNLEtBQUssR0FDVCxnQkFBZ0IsQ0FBQywrQkFBK0I7b0JBQ2hELGdCQUFnQixDQUFDLDZCQUE2QixDQUFBO2dCQUNoRCxNQUFNLEtBQUssR0FBaUI7b0JBQzFCLFlBQVksRUFBRSxlQUFlO29CQUM3QixPQUFPLEVBQUUsT0FBTyxDQUFDLEtBQUs7b0JBQ3RCLEtBQUs7aUJBQ04sQ0FBQTtnQkFFRDs7bUJBRUc7Z0JBQ0gsUUFBUSxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLENBQUE7Z0JBQ3hELE9BQU8sUUFBUSxDQUFBO2FBQ2hCO1lBRUQ7Ozs7Ozs7O2VBUUc7WUFDSCxLQUFLLENBQ0gsUUFBUSxDQUFDLFdBQVcsRUFBRTtnQkFDcEIsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsRUFDaEQsU0FBUyxDQUFDLE1BQU0sQ0FDZCxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxLQUFLLEtBQUssRUFDcEQsdUVBQXVFLENBQ3hFLENBQ0YsQ0FBQTtZQUVELE9BQU8sUUFBUSxDQUFBO1FBQ2pCLENBQUM7S0FDRjtJQUNELGNBQWMsQ0FBQyxVQUFVLENBQUMsQ0FBQTtJQUMxQixPQUFPLFVBQVUsQ0FBQTtBQUNuQixDQUFDIn0=
+function filterEDKs(keyIds, { isDiscovery, discoveryFilter }) {
+    return function filter({ providerId, providerInfo }) {
+        /* Check for early return (Postcondition): Only AWS KMS EDK should be attempted. */
+        if (providerId !== KMS_PROVIDER_ID)
+            return false;
+        /* Discovery keyrings can not have keyIds configured,
+         * and non-discovery keyrings must have keyIds configured.
+         */
+        if (isDiscovery) {
+            /* Check for early return (Postcondition): There is no discoveryFilter to further condition discovery. */
+            if (!discoveryFilter)
+                return true;
+            /* If the providerInfo is an invalid ARN this will throw.
+             * But, this function is also used to extract regions
+             * from an CMK to generate a regional client.
+             * This means it will NOT throw for something
+             * that looks like a bare alias or key id.
+             * However, these constructions will not have an account or partition.
+             */
+            const { account, partition } = decomposeAwsKmsKeyArn(providerInfo);
+            /* Postcondition: The account and partition *must* match the discovery filter.
+             * Since we are offering a runtime discovery of CMKs
+             * it is best to have some form of filter on this.
+             * The providerInfo is a CMK ARN and will have the account and partition.
+             * By offering these levers customers can easily bound
+             * the CMKs to ones they control without knowing the CMKs
+             * when the AWS KMS Keyring is instantiated.
+             */
+            return (discoveryFilter.partition === partition &&
+                discoveryFilter.accountIDs.some((a) => a === account));
+        }
+        else {
+            /* Postcondition: The EDK CMK (providerInfo) *must* match a configured CMK. */
+            return keyIds.includes(providerInfo);
+        }
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX2tleXJpbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMva21zX2tleXJpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0VBQW9FO0FBQ3BFLHNDQUFzQztBQUl0QyxPQUFPLEVBQ0wsS0FBSyxFQU1MLGdCQUFnQixFQUVoQixjQUFjLEVBQ2QsZ0JBQWdCLEVBQ2hCLGFBQWEsR0FDZCxNQUFNLGlDQUFpQyxDQUFBO0FBQ3hDLE9BQU8sRUFDTCxlQUFlLEVBQ2YsZUFBZSxFQUNmLE9BQU8sRUFDUCxPQUFPLEVBQ1AsNkJBQTZCLEdBQzlCLE1BQU0sV0FBVyxDQUFBO0FBQ2xCLE9BQU8sRUFDTCxtQkFBbUIsRUFDbkIscUJBQXFCLEdBQ3RCLE1BQU0sMkJBQTJCLENBQUE7QUE2Q2xDLE1BQU0sVUFBVSxlQUFlLENBRzdCLFdBQW9DO0lBQ3BDLE1BQU0sVUFBVyxTQUFRLFdBQVc7UUFXbEMsWUFBWSxFQUNWLGNBQWMsRUFDZCxjQUFjLEVBQ2QsTUFBTSxHQUFHLEVBQUUsRUFDWCxXQUFXLEVBQ1gsU0FBUyxFQUNULGVBQWUsR0FDUztZQUN4QixLQUFLLEVBQUUsQ0FBQTtZQUNQLHVHQUF1RztZQUN2RyxLQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsS0FBSyxVQUFVLEVBQUUsK0JBQStCLENBQUMsQ0FBQTtZQUN2RSxxREFBcUQ7WUFDckQsS0FBSyxDQUNILENBQUMsQ0FBQyxDQUFDLFNBQVMsSUFBSSxDQUFDLGNBQWMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFDbEQsdURBQXVELENBQ3hELENBQUE7WUFDRCxrRkFBa0Y7WUFDbEYsS0FBSyxDQUNILENBQUMsQ0FBQyxTQUFTLElBQUksQ0FBQyxjQUFjLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQ2pELGdFQUFnRSxDQUNqRSxDQUFBO1lBQ0QsOEVBQThFO1lBQzlFLEtBQUssQ0FDSCxTQUFTLElBQUksQ0FBQyxDQUFDLFNBQVMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxFQUM3QyxvRkFBb0YsQ0FDckYsQ0FBQTtZQUNEOzs7O2VBSUc7WUFDSCxLQUFLLENBQ0gsQ0FBQyxlQUFlO2dCQUNkLENBQUMsZUFBZSxDQUFDLFVBQVU7b0JBQ3pCLGVBQWUsQ0FBQyxVQUFVLENBQUMsTUFBTTtvQkFDakMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxTQUFTO29CQUMzQixlQUFlLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FDOUIsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUNwQyxDQUFDLEVBQ04scURBQXFELENBQ3RELENBQUE7WUFFRCwwREFBMEQ7WUFDMUQsS0FBSyxDQUNILENBQUMsY0FBYztnQkFDYixPQUFPLG1CQUFtQixDQUFDLGNBQWMsQ0FBQyxLQUFLLFFBQVEsRUFDekQsZ0JBQWdCLENBQ2pCLENBQUE7WUFDRCxLQUFLLENBQ0gsTUFBTSxDQUFDLEtBQUssQ0FDVixDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsT0FBTyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsS0FBSyxRQUFRLENBQzVELEVBQ0QsZ0JBQWdCLENBQ2pCLENBQUE7WUFDRCxtRUFBbUU7WUFDbkUsS0FBSyxDQUFDLE9BQU8sY0FBYyxLQUFLLFVBQVUsRUFBRSx3QkFBd0IsQ0FBQyxDQUFBO1lBRXJFLGdCQUFnQixDQUFDLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxjQUFjLENBQUMsQ0FBQTtZQUN4RCxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQTtZQUMvRCxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxDQUFDLENBQUE7WUFDeEQsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRSxXQUFXLENBQUMsQ0FBQTtZQUNsRCxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsYUFBYSxFQUFFLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQTtZQUNsRCxnQkFBZ0IsQ0FDZCxJQUFJLEVBQ0osaUJBQWlCLEVBQ2pCLGVBQWU7Z0JBQ2IsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7b0JBQ1osR0FBRyxlQUFlO29CQUNsQixVQUFVLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDO2lCQUN0RCxDQUFDO2dCQUNKLENBQUMsQ0FBQyxlQUFlLENBQ3BCLENBQUE7UUFDSCxDQUFDO1FBRUQsaUdBQWlHO1FBQ2pHLEtBQUssQ0FBQyxVQUFVLENBQUMsUUFBK0I7WUFDOUMsZ0ZBQWdGO1lBQ2hGLElBQUksSUFBSSxDQUFDLFdBQVc7Z0JBQUUsT0FBTyxRQUFRLENBQUE7WUFFckMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQTtZQUNsQyxNQUFNLEVBQUUsY0FBYyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFJLENBQUE7WUFDNUQsSUFBSSxjQUFjLElBQUksQ0FBQyxRQUFRLENBQUMscUJBQXFCLEVBQUU7Z0JBQ3JELE1BQU0sT0FBTyxHQUFHLE1BQU0sZUFBZSxDQUNuQyxjQUFjLEVBQ2QsUUFBUSxDQUFDLEtBQUssQ0FBQyxjQUFjLEVBQzdCLGNBQWMsRUFDZCxRQUFRLENBQUMsaUJBQWlCLEVBQzFCLFdBQVcsQ0FDWixDQUFBO2dCQUNEOzs7O21CQUlHO2dCQUNILElBQUksQ0FBQyxPQUFPO29CQUNWLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQTtnQkFFbEUsTUFBTSxLQUFLLEdBQ1QsZ0JBQWdCLENBQUMsK0JBQStCO29CQUNoRCxnQkFBZ0IsQ0FBQywyQkFBMkI7b0JBQzVDLGdCQUFnQixDQUFDLCtCQUErQixDQUFBO2dCQUNsRCxNQUFNLEtBQUssR0FBaUI7b0JBQzFCLFlBQVksRUFBRSxlQUFlO29CQUM3QixPQUFPLEVBQUUsT0FBTyxDQUFDLEtBQUs7b0JBQ3RCLEtBQUs7aUJBQ04sQ0FBQTtnQkFFRCxRQUFRO29CQUNOOzt1QkFFRztxQkFDRixxQkFBcUIsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQztxQkFDL0MsbUJBQW1CLENBQ2xCLDZCQUE2QixDQUFDLE9BQU8sQ0FBQyxFQUN0QyxnQkFBZ0IsQ0FBQywrQkFBK0I7b0JBQzlDLGdCQUFnQixDQUFDLDJCQUEyQixDQUMvQyxDQUFBO2FBQ0o7aUJBQU0sSUFBSSxjQUFjLEVBQUU7Z0JBQ3pCLE1BQU0sQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUE7YUFDL0I7WUFFRDs7O2VBR0c7WUFDSCxNQUFNLGtCQUFrQixHQUFHLGFBQWEsQ0FBQyxRQUFRLENBQUMscUJBQXFCLEVBQUUsQ0FBQyxDQUFBO1lBRTFFLE1BQU0sS0FBSyxHQUNULGdCQUFnQixDQUFDLCtCQUErQjtnQkFDaEQsZ0JBQWdCLENBQUMsMkJBQTJCLENBQUE7WUFDOUMsS0FBSyxNQUFNLE1BQU0sSUFBSSxNQUFNLEVBQUU7Z0JBQzNCLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUMxQixjQUFjLEVBQ2Qsa0JBQWtCLEVBQ2xCLE1BQU0sRUFDTixRQUFRLENBQUMsaUJBQWlCLEVBQzFCLFdBQVcsQ0FDWixDQUFBO2dCQUVELHFGQUFxRjtnQkFDckYsSUFBSSxNQUFNO29CQUNSLFFBQVEsQ0FBQyxtQkFBbUIsQ0FDMUIsNkJBQTZCLENBQUMsTUFBTSxDQUFDLEVBQ3JDLEtBQUssQ0FDTixDQUFBO2FBQ0o7WUFFRCxPQUFPLFFBQVEsQ0FBQTtRQUNqQixDQUFDO1FBRUQsS0FBSyxDQUFDLFVBQVUsQ0FDZCxRQUErQixFQUMvQixpQkFBcUM7WUFFckMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQTtZQUNsQyxNQUFNLEVBQUUsY0FBYyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFJLENBQUE7WUFDNUQsSUFBSSxjQUFjO2dCQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUE7WUFFbEQ7Ozs7O2VBS0c7WUFDSCxNQUFNLGVBQWUsR0FBRyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFBO1lBRTFFLE1BQU0sU0FBUyxHQUFZLEVBQUUsQ0FBQTtZQUU3QixLQUFLLE1BQU0sR0FBRyxJQUFJLGVBQWUsRUFBRTtnQkFDakMsSUFBSSxPQUFPLEdBQW9DLEtBQUssQ0FBQTtnQkFDcEQsSUFBSTtvQkFDRixPQUFPLEdBQUcsTUFBTSxPQUFPLENBQ3JCLGNBQWMsRUFDZCxHQUFHLEVBQ0gsUUFBUSxDQUFDLGlCQUFpQixFQUMxQixXQUFXLENBQ1osQ0FBQTtpQkFDRjtnQkFBQyxPQUFPLENBQUMsRUFBRTtvQkFDVjs7O3VCQUdHO29CQUNILFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUE7aUJBQ2xCO2dCQUVELHFGQUFxRjtnQkFDckYsSUFBSSxDQUFDLE9BQU87b0JBQUUsU0FBUTtnQkFFdEIscUVBQXFFO2dCQUNyRSxLQUFLLENBQ0gsT0FBTyxDQUFDLEtBQUssS0FBSyxHQUFHLENBQUMsWUFBWSxFQUNsQyx3REFBd0QsQ0FDekQsQ0FBQTtnQkFFRCxNQUFNLEtBQUssR0FDVCxnQkFBZ0IsQ0FBQywrQkFBK0I7b0JBQ2hELGdCQUFnQixDQUFDLDZCQUE2QixDQUFBO2dCQUNoRCxNQUFNLEtBQUssR0FBaUI7b0JBQzFCLFlBQVksRUFBRSxlQUFlO29CQUM3QixPQUFPLEVBQUUsT0FBTyxDQUFDLEtBQUs7b0JBQ3RCLEtBQUs7aUJBQ04sQ0FBQTtnQkFFRDs7bUJBRUc7Z0JBQ0gsUUFBUSxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLENBQUE7Z0JBQ3hELE9BQU8sUUFBUSxDQUFBO2FBQ2hCO1lBRUQ7Ozs7Ozs7O2VBUUc7WUFDSCxLQUFLLENBQ0gsUUFBUSxDQUFDLFdBQVcsRUFBRTtnQkFDcEIsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsRUFDaEQsU0FBUyxDQUFDLE1BQU0sQ0FDZCxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxLQUFLLEtBQUssRUFDcEQsdUVBQXVFLENBQ3hFLENBQ0YsQ0FBQTtZQUVELE9BQU8sUUFBUSxDQUFBO1FBQ2pCLENBQUM7S0FDRjtJQUNELGNBQWMsQ0FBQyxVQUFVLENBQUMsQ0FBQTtJQUMxQixPQUFPLFVBQVUsQ0FBQTtBQUNuQixDQUFDO0FBRUQsU0FBUyxVQUFVLENBR2pCLE1BQWdCLEVBQUUsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFzQjtJQUN0RSxPQUFPLFNBQVMsTUFBTSxDQUFDLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBb0I7UUFDbkUsbUZBQW1GO1FBQ25GLElBQUksVUFBVSxLQUFLLGVBQWU7WUFBRSxPQUFPLEtBQUssQ0FBQTtRQUNoRDs7V0FFRztRQUNILElBQUksV0FBVyxFQUFFO1lBQ2YseUdBQXlHO1lBQ3pHLElBQUksQ0FBQyxlQUFlO2dCQUFFLE9BQU8sSUFBSSxDQUFBO1lBRWpDOzs7Ozs7ZUFNRztZQUNILE1BQU0sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLEdBQUcscUJBQXFCLENBQUMsWUFBWSxDQUFDLENBQUE7WUFDbEU7Ozs7Ozs7ZUFPRztZQUNILE9BQU8sQ0FDTCxlQUFlLENBQUMsU0FBUyxLQUFLLFNBQVM7Z0JBQ3ZDLGVBQWUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEtBQUssT0FBTyxDQUFDLENBQ3RELENBQUE7U0FDRjthQUFNO1lBQ0wsOEVBQThFO1lBQzlFLE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQTtTQUNyQztJQUNILENBQUMsQ0FBQTtBQUNILENBQUMifQ==

build/module/kms_types.d.ts

 /// <reference types="node" />
 import { EncryptionContext } from '@aws-crypto/material-management';
 export interface DecryptRequest {
+    KeyId?: string;
     CiphertextBlob: Uint8Array;
@@ -5,0 +6,0 @@ EncryptionContext?: EncryptionContext;

build/module/kms_types.js

 // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
+export {};
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia21zX3R5cGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2ttc190eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxvRUFBb0U7QUFDcEUsc0NBQXNDIn0=

build/module/region_from_kms_key_arn.d.ts

 export declare function regionFromKmsKeyArn(kmsKeyArn: string): string;
+export declare function decomposeAwsKmsKeyArn(kmsKeyArn: string): {
+    region: string;
+    account: string;
+    partition: string;
+};
 //# sourceMappingURL=region_from_kms_key_arn.d.ts.map

build/module/region_from_kms_key_arn.js

@@ -12,3 +12,8 @@ // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
 const aliasOrKeyResourceType = /^(alias|key)(\/.*)*$/;
+/* Maintaining function for backwards compatibility. */
 export function regionFromKmsKeyArn(kmsKeyArn) {
+    const { region } = decomposeAwsKmsKeyArn(kmsKeyArn);
+    return region;
+}
+export function decomposeAwsKmsKeyArn(kmsKeyArn) {
     /* Precondition: A KMS key arn must be a string. */
@@ -20,3 +25,3 @@ needs(typeof kmsKeyArn === 'string', 'KMS key arn must be a string.');
      */
-    const [arnLiteral, partition, service, region = ''] = kmsKeyArn.split(':');
+    const [arnLiteral, partition, service, region = '', account = '',] = kmsKeyArn.split(':');
     /* Postcondition: The ARN must be well formed.
@@ -38,4 +43,4 @@ * The arn and kms section have defined values,
         (!service && !region && arnLiteral.match(aliasOrKeyResourceType)), 'Malformed arn.');
-    return region;
+    return { region, account, partition };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaW9uX2Zyb21fa21zX2tleV9hcm4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcmVnaW9uX2Zyb21fa21zX2tleV9hcm4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0VBQW9FO0FBQ3BFLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUNBQWlDLENBQUE7QUFFdkQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxzQkFBc0IsR0FBRyxzQkFBc0IsQ0FBQTtBQUVyRCxNQUFNLFVBQVUsbUJBQW1CLENBQUMsU0FBaUI7SUFDbkQsbURBQW1EO0lBQ25ELEtBQUssQ0FBQyxPQUFPLFNBQVMsS0FBSyxRQUFRLEVBQUUsK0JBQStCLENBQUMsQ0FBQTtJQUVyRTs7O09BR0c7SUFDSCxNQUFNLENBQUMsVUFBVSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsTUFBTSxHQUFHLEVBQUUsQ0FBQyxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUE7SUFFMUU7Ozs7Ozs7T0FPRztJQUNILEtBQUssQ0FDSCxDQUFDLFVBQVUsS0FBSyxLQUFLLElBQUksU0FBUyxJQUFJLE9BQU8sS0FBSyxLQUFLLElBQUksTUFBTSxDQUFDO1FBQ2hFOzs7OztXQUtHO1FBQ0gsQ0FBQyxDQUFDLE9BQU8sSUFBSSxDQUFDLE1BQU0sSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDLENBQUMsRUFDbkUsZ0JBQWdCLENBQ2pCLENBQUE7SUFFRCxPQUFPLE1BQU0sQ0FBQTtBQUNmLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaW9uX2Zyb21fa21zX2tleV9hcm4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcmVnaW9uX2Zyb21fa21zX2tleV9hcm4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0VBQW9FO0FBQ3BFLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUNBQWlDLENBQUE7QUFFdkQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxzQkFBc0IsR0FBRyxzQkFBc0IsQ0FBQTtBQUVyRCx1REFBdUQ7QUFDdkQsTUFBTSxVQUFVLG1CQUFtQixDQUFDLFNBQWlCO0lBQ25ELE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsQ0FBQTtJQUNuRCxPQUFPLE1BQU0sQ0FBQTtBQUNmLENBQUM7QUFFRCxNQUFNLFVBQVUscUJBQXFCLENBQ25DLFNBQWlCO0lBRWpCLG1EQUFtRDtJQUNuRCxLQUFLLENBQUMsT0FBTyxTQUFTLEtBQUssUUFBUSxFQUFFLCtCQUErQixDQUFDLENBQUE7SUFFckU7OztPQUdHO0lBQ0gsTUFBTSxDQUNKLFVBQVUsRUFDVixTQUFTLEVBQ1QsT0FBTyxFQUNQLE1BQU0sR0FBRyxFQUFFLEVBQ1gsT0FBTyxHQUFHLEVBQUUsRUFDYixHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUE7SUFFeEI7Ozs7Ozs7T0FPRztJQUNILEtBQUssQ0FDSCxDQUFDLFVBQVUsS0FBSyxLQUFLLElBQUksU0FBUyxJQUFJLE9BQU8sS0FBSyxLQUFLLElBQUksTUFBTSxDQUFDO1FBQ2hFOzs7OztXQUtHO1FBQ0gsQ0FBQyxDQUFDLE9BQU8sSUFBSSxDQUFDLE1BQU0sSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDLENBQUMsRUFDbkUsZ0JBQWdCLENBQ2pCLENBQUE7SUFFRCxPQUFPLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsQ0FBQTtBQUN2QyxDQUFDIn0=

CHANGELOG.md

@@ -6,2 +6,13 @@ # Change Log
 
+# [1.7.0](https://github.com/aws/private-aws-encryption-sdk-javascript-staging/compare/@aws-crypto/kms-keyring@1.1.1...@aws-crypto/kms-keyring@1.7.0) (2020-09-24)
+
+
+### Features
+
+* Updates to the AWS Encryption SDK. ([748be9e](https://github.com/aws/private-aws-encryption-sdk-javascript-staging/commit/748be9e1799d999a350e9cafbf902d43aeab0aa5))
+
+
+
+
+
 ## [1.1.1](https://github.com/aws/aws-encryption-sdk-javascript/compare/@aws-crypto/kms-keyring@1.1.0...@aws-crypto/kms-keyring@1.1.1) (2020-05-26)
@@ -8,0 +19,0 @@

package.json

 {
   "name": "@aws-crypto/kms-keyring",
-  "version": "1.1.1",
+  "version": "1.7.0",
   "scripts": {
@@ -21,3 +21,3 @@ "prepublishOnly": "npm run build",
   "dependencies": {
-    "@aws-crypto/material-management": "^1.0.4",
+    "@aws-crypto/material-management": "^1.7.0",
     "tslib": "^1.11.1"
@@ -32,3 +32,3 @@ },
   ],
-  "gitHead": "4b60e0607e83d1ea2da98fd593e681f98f0d0082"
+  "gitHead": "4469f3ec0ea8dc42ac5fec37ba0c207675d46e69"
 }

No alert changes

Improved metrics

Total package byte prevSize

398554

increased by8.77%

Lines of code

1177

increased by14.72%

Dependency changes

• Updated@aws-crypto/material-management@^1.7.0