Java 类com.amazonaws.auth.AWSCredentialsProvider 实例源码

public static AWSCredentialsProvider buildCredentials(Logger logger, DeprecationLogger deprecationLogger,
                                                      Settings settings, Settings repositorySettings, String clientName) {
    try (SecureString key = getConfigValue(repositorySettings, settings, clientName, S3Repository.ACCESS_KEY_SETTING,
                                           S3Repository.Repository.KEY_SETTING, S3Repository.Repositories.KEY_SETTING);
         SecureString secret = getConfigValue(repositorySettings, settings, clientName, S3Repository.SECRET_KEY_SETTING,
                                              S3Repository.Repository.SECRET_SETTING, S3Repository.Repositories.SECRET_SETTING)) {

        if (key.length() == 0 && secret.length() == 0) {
            logger.debug("Using instance profile credentials");
            return new PrivilegedInstanceProfileCredentialsProvider();
        } else {
            logger.debug("Using basic key/secret credentials");
            return new StaticCredentialsProvider(new BasicAWSCredentials(key.toString(), secret.toString()));
        }
    }
}

/**
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCredentials(AWSCredentialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCryptoConfiguration(CryptoConfiguration)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withClientConfiguration(ClientConfiguration)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withMetricsCollector(RequestMetricCollector)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withKmsClient(AWSKMS)}
 */
@Deprecated
public AmazonS3EncryptionClient(AWSKMSClient kms,
        AWSCredentialsProvider credentialsProvider,
        EncryptionMaterialsProvider kekMaterialsProvider,
        ClientConfiguration clientConfig,
        CryptoConfiguration cryptoConfig,
        RequestMetricCollector requestMetricCollector) {
    super(credentialsProvider, clientConfig, requestMetricCollector);
    assertParameterNotNull(kekMaterialsProvider,
            "EncryptionMaterialsProvider parameter must not be null.");
    assertParameterNotNull(cryptoConfig,
            "CryptoConfiguration parameter must not be null.");
    this.isKMSClientInternal = kms == null;
    this.kms = isKMSClientInternal 
        ? newAWSKMSClient(credentialsProvider, clientConfig, cryptoConfig, 
                requestMetricCollector)
        : kms;
    this.crypto = new CryptoModuleDispatcher(this.kms, new S3DirectImpl(),
            credentialsProvider, kekMaterialsProvider, cryptoConfig);
}

@Bean
public AmazonCloudWatch amazonCloudWatchClient(final AWSCredentialsProvider awsCredentialsProvider, 
    final ClientConfiguration awsClientConfig, final Region awsRegion) {
    return AmazonCloudWatchClientBuilder.standard()
        .withCredentials(awsCredentialsProvider)
        .withClientConfiguration(awsClientConfig)
        .withRegion(awsRegion.getName())
        .build();
}

@Override
public Credentials configure(final Host host) {
    final Credentials credentials = host.getCredentials();
    // Only for AWS
    if(host.getHostname().endsWith(PreferencesFactory.get().getProperty("s3.hostname.default"))) {
        if(!credentials.validate(host.getProtocol(), new LoginOptions(host.getProtocol()).password(false))) {
            // Lookup from default profile if no access key is set in bookmark
            for(AWSCredentialsProvider provider : providers) {
                try {
                    final AWSCredentials c = provider.getCredentials();
                    credentials.setUsername(c.getAWSAccessKeyId());
                    credentials.setPassword(c.getAWSSecretKey());
                    break;
                }
                catch(SdkClientException e) {
                    log.debug(String.format("Ignore failure loading credentials from provider %s", provider));
                    // Continue searching with next provider
                }
            }
        }
    }
    return credentials;
}

public GenericDynamoDB(AmazonDynamoDB client, AWSCredentialsProvider awsCredentials,
                       ClientConfiguration clientConfiguration,
                       SecretsGroupIdentifier groupIdentifier, Class<Entry> clazz, Converters converters,
                       ReadWriteLock readWriteLock) {
    this.clazz = clazz;
    buildMappings();
    this.converters = converters;
    this.awsCredentials = awsCredentials;
    this.clientConfiguration = clientConfiguration;
    this.client = client;
    this.region = RegionUtils.getRegion(groupIdentifier.region.getName());
    this.readWriteLock = readWriteLock;

    RegionLocalResourceName resourceName = new RegionLocalResourceName(groupIdentifier);
    this.tableName = resourceName.toString();
}

private static void cleanUpKMSKeys(Regions testRegion, String testResourcePrefix, Date createdBeforeThreshold,
                                   AWSCredentialsProvider awsCredentials) {
    LOG.info("Cleaning KMS...");

    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withCredentials(awsCredentials)
            .withRegion(testRegion)
            .build();

    List<AliasListEntry> keys = kmsClient.listAliases().getAliases();
    for (AliasListEntry entry: keys) {
        if (!entry.getAliasName().startsWith("alias/" + testResourcePrefix)) {
            continue;
        }

        DescribeKeyRequest request = new DescribeKeyRequest().withKeyId(entry.getTargetKeyId());
        KeyMetadata metadata = kmsClient.describeKey(request).getKeyMetadata();

        if (KMSKeyState.fromString(metadata.getKeyState()) != KMSKeyState.PENDING_DELETION &&
                metadata.getCreationDate().before(createdBeforeThreshold)) {
            LOG.info("Scheduling KMS key for deletion:" + entry.getAliasName());
            scheduleKeyDeletion(kmsClient, entry);
        }
    }
}

@BeforeMethod
public void setUp() throws Exception {
    AWSCredentialsProvider mockCredentials = mock(AWSCredentialsProvider.class);
    ClientConfiguration mockConfig = mock(ClientConfiguration.class);
    SecretsGroupIdentifier group = new SecretsGroupIdentifier(Region.US_WEST_1, "test.group");

    this.mockAwsCrypto = mock(AwsCrypto.class);
    this.mockKmsManager = mock(KMSManager.class);
    KMSEncryptor encryptor = new KMSEncryptor(mockKmsManager, mockCredentials, mockConfig, group, mockAwsCrypto, EncryptionStrength.AES_256);

    this.kmsEncryptor = spy(encryptor);
    this.mockProvider = mock(KmsMasterKeyProvider.class);
    doReturn(mockProvider).when(kmsEncryptor).getProvider();

    // Verify the expected encryption algorithm was set.
    verify(mockAwsCrypto, times(1)).setEncryptionAlgorithm(
            CryptoAlgorithm.ALG_AES_256_GCM_IV12_TAG16_HKDF_SHA384_ECDSA_P384);
}

public Profile(String profileName, String sourceProfile, AWSCredentialsProvider awsCredentials, RoleInfo roleInfo) {
    Map<String, String> properties = new LinkedHashMap<String, String>();
    properties.put(ProfileKeyConstants.SOURCE_PROFILE, sourceProfile);
    properties.put(ProfileKeyConstants.ROLE_ARN, roleInfo.getRoleArn());

    if (roleInfo.getRoleSessionName() != null) {
        properties.put(ProfileKeyConstants.ROLE_SESSION_NAME, roleInfo.getRoleSessionName());
    }

    if (roleInfo.getExternalId() != null) {
        properties.put(ProfileKeyConstants.EXTERNAL_ID, roleInfo.getExternalId());
    }

    this.profileName = profileName;
    this.properties = properties;
    this.awsCredentials = awsCredentials;
}

LinkGeneratorLambdaHandler(String region, String jwtEncryptKeyArn, String pageStorageBucket, String authVerifyEndpointURL,
                           AWSCredentialsProvider awsCredential, String introPageTemplateName) throws IOException, TemplateException {
    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withCredentials(awsCredential)
            .withRegion(region)
            .build();
    AmazonS3 s3client = AmazonS3ClientBuilder
            .standard()
            .withCredentials(awsCredential)
            .withRegion(region)
            .build();
    kmsEncrypt = new KMSEncrypt(kmsClient, jwtEncryptKeyArn);
    this.pageStorageBucket = pageStorageBucket;
    this.authVerifyEndpointURL = authVerifyEndpointURL;
    this.pageUploader = new PageUploader(s3client, pageStorageBucket);


    this.introPageTemplate = new IntroPageTemplate(introPageTemplateName);
}

private GetMediaWorker(Regions region,
        AWSCredentialsProvider credentialsProvider,
        String streamName,
        StartSelector startSelector,
        String endPoint,
        MkvElementVisitor elementVisitor) {
    super(region, credentialsProvider, streamName);

    AmazonKinesisVideoMediaClientBuilder builder = AmazonKinesisVideoMediaClientBuilder.standard()
            .withEndpointConfiguration(new AwsClientBuilder.EndpointConfiguration(endPoint, region.getName()))
            .withCredentials(getCredentialsProvider());

    this.videoMedia = builder.build();
    this.elementVisitor = elementVisitor;
    this.startSelector = startSelector;
}

/**
 *
 * @param service service that we're connecting to
 * @param signer particular signer implementation
 * @param awsCredentialsProvider source of AWS credentials for signing
 */
public AWSRequestSigningApacheInterceptor(final String service,
                            final Signer signer,
                            final AWSCredentialsProvider awsCredentialsProvider) {
    this.service = service;
    this.signer = signer;
    this.awsCredentialsProvider = awsCredentialsProvider;
}

@Test
public void testCredentialsSetInRequestContext() throws Exception {
    EasyMock.reset(httpClient);
    EasyMock
            .expect(httpClient.execute(EasyMock.<HttpRequestBase>anyObject(), EasyMock.<HttpContext>anyObject()))
            .andReturn(createBasicHttpResponse())
            .once();
    EasyMock.replay(httpClient);

    AmazonHttpClient client = new AmazonHttpClient(new ClientConfiguration(), httpClient, null);

    final BasicAWSCredentials credentials = new BasicAWSCredentials("foo", "bar");

    AWSCredentialsProvider credentialsProvider = EasyMock.createMock(AWSCredentialsProvider.class);
    EasyMock.expect(credentialsProvider.getCredentials())
            .andReturn(credentials)
            .anyTimes();
    EasyMock.replay(credentialsProvider);

    ExecutionContext executionContext = new ExecutionContext();
    executionContext.setCredentialsProvider(credentialsProvider);

    Request<?> request = mockRequest(SERVER_NAME, HttpMethodName.PUT, URI_NAME, true);

    HttpResponseHandler<AmazonWebServiceResponse<Object>> handler = createStubResponseHandler();
    EasyMock.replay(handler);

    client.execute(request, handler, null, executionContext);

    assertEquals(credentials, request.getHandlerContext(HandlerContextKey.AWS_CREDENTIALS));
}

@Bean
public SQSConnection sqsConnection(final AWSCredentialsProvider awsCredentialsProvider,
    final ClientConfiguration awsClientConfig, final Region awsRegion) throws JMSException {

    SQSConnectionFactory connectionFactory = SQSConnectionFactory.builder()
        .withRegion(awsRegion) //Gets region form meta data
        .withAWSCredentialsProvider(awsCredentialsProvider)
        .withClientConfiguration(awsClientConfig)
        .build();

    return connectionFactory.createConnection();
}

@Bean
public AmazonEC2 amazonEC2Client(final AWSCredentialsProvider awsCredentialsProvider,
    final ClientConfiguration awsClientConfig, final Region awsRegion) {
    return AmazonEC2ClientBuilder.standard()
        .withCredentials(awsCredentialsProvider)
        .withClientConfiguration(awsClientConfig)
        .withRegion(awsRegion.getName())
        .build();
}

@Bean
public AmazonElasticLoadBalancing amazonElbClient(final AWSCredentialsProvider awsCredentialsProvider,
    final ClientConfiguration awsClientConfig, final Region awsRegion) {
    return AmazonElasticLoadBalancingClientBuilder.standard()
        .withCredentials(awsCredentialsProvider)
        .withClientConfiguration(awsClientConfig)
        .withRegion(awsRegion.getName())
        .build();
}

@Bean
public AmazonAutoScaling amazonAutoScalingClient(final AWSCredentialsProvider awsCredentialsProvider,
    final ClientConfiguration awsClientConfig, final Region awsRegion) {
    return AmazonAutoScalingClientBuilder.standard()
        .withCredentials(awsCredentialsProvider)
        .withClientConfiguration(awsClientConfig)
        .withRegion(awsRegion.getName())
        .build();
}

@Bean
public AmazonCloudFormation amazonCloudFormationClient(final AWSCredentialsProvider awsCredentialsProvider,
    final ClientConfiguration awsClientConfig, final Region awsRegion) {
    return AmazonCloudFormationClientBuilder.standard()
        .withCredentials(awsCredentialsProvider)
        .withClientConfiguration(awsClientConfig)
        .withRegion(awsRegion.getName())
        .build();
}

@Bean
public AmazonS3 amazonS3Client(final AWSCredentialsProvider awsCredentialsProvider, 
    final ClientConfiguration awsClientConfig, final Region awsRegion) {
    return AmazonS3ClientBuilder.standard()
        .withCredentials(awsCredentialsProvider)
        .withClientConfiguration(awsClientConfig)
        .withRegion(awsRegion.getName())
        .build();
}

/**
 * @param cryptoConfig a read-only copy of the crypto configuration.
 */
protected S3CryptoModuleBase(AWSKMS kms, S3Direct s3,
        AWSCredentialsProvider credentialsProvider,
        EncryptionMaterialsProvider kekMaterialsProvider,
        CryptoConfiguration cryptoConfig) {
    if (!cryptoConfig.isReadOnly())
        throw new IllegalArgumentException("The cryto configuration parameter is required to be read-only");
    this.kekMaterialsProvider = kekMaterialsProvider;
    this.s3 = s3;
    this.cryptoConfig = cryptoConfig;
    this.cryptoScheme = S3CryptoScheme.from(cryptoConfig.getCryptoMode());
    this.contentCryptoScheme = cryptoScheme.getContentCryptoScheme();
    this.kms = kms;
}

@Bean
public AWSCredentialsProvider awsCredentialsProvider() {
    /*
     * For info on how this works, see:
     * http://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/
     * credentials.html
     */
    return new DefaultAWSCredentialsProviderChain();
}

@Bean
public SQSConnection sqsConnection(AWSCredentialsProvider awsCredentialsProvider,
                                   ClientConfiguration awsClientConfig) throws JMSException {

    SQSConnectionFactory connectionFactory = SQSConnectionFactory.builder()
            .withRegion(RegionUtils.getRegion(awsRegion))
            .withAWSCredentialsProvider(awsCredentialsProvider)
            .withClientConfiguration(awsClientConfig)
            .build();

    return connectionFactory.createConnection();
}

@Bean
@ConditionalOnMissingBean(AmazonCloudWatchAsyncClient.class)
public AmazonCloudWatchAsync amazonCloudWatchAsync(AWSCredentialsProvider credentialsProvider) {
    return AmazonCloudWatchAsyncClientBuilder.standard()
        .withCredentials(credentialsProvider)
        .build();
}

/**
 * Constructor
 * 
 * @param ph
 */
public EC2Communication(PropertyHandler ph) {
    this.ph = ph;
    final String secretKey = ph.getSecretKey();
    final String accessKeyId = ph.getAccessKeyId();

    credentialsProvider = new AWSCredentialsProvider() {

        @Override
        public void refresh() {
        }

        @Override
        public AWSCredentials getCredentials() {

            return new AWSCredentials() {

                @Override
                public String getAWSSecretKey() {
                    return secretKey;
                }

                @Override
                public String getAWSAccessKeyId() {
                    return accessKeyId;
                }
            };
        }
    };
}

@Bean
AmazonSNSAsyncClient amazonSNS(ListenerConfig config, AWSCredentialsProvider awsCredentialsProvider) {
  AmazonSNSAsyncClient client = new AmazonSNSAsyncClient(awsCredentialsProvider,
      new ClientConfiguration().withRetryPolicy(PredefinedRetryPolicies.getDefaultRetryPolicy()),
      Executors.newSingleThreadScheduledExecutor());
  client.setRegion(Region.getRegion(Regions.fromName(config.getRegion())));
  return client;
}

@Test
public void credentials() throws IOException {
  when(conf.getPassword("access.key")).thenReturn("accessKey".toCharArray());
  when(conf.getPassword("secret.key")).thenReturn("secretKey".toCharArray());
  AWSCredentialsProvider credentialsProvider = configuration.awsCredentialsProvider(conf);
  AWSCredentials awsCredentials = credentialsProvider.getCredentials();
  assertThat(awsCredentials.getAWSAccessKeyId(), is("accessKey"));
  assertThat(awsCredentials.getAWSSecretKey(), is("secretKey"));
}

@Test
public void snsClient() {
  AWSCredentialsProvider credentialsProvider = mock(AWSCredentialsProvider.class);
  when(credentialsProvider.getCredentials()).thenReturn(new BasicAWSCredentials("accessKey", "secretKey"));
  ListenerConfig config = new ListenerConfig();
  config.setRegion("eu-west-1");
  AmazonSNS sns = configuration.amazonSNS(config, credentialsProvider);
  assertThat(sns, is(not(nullValue())));
}

GenericApiGatewayClient(ClientConfiguration clientConfiguration, String endpoint, Region region,
                        AWSCredentialsProvider credentials, String apiKey, AmazonHttpClient httpClient) {
    super(clientConfiguration);
    setRegion(region);
    setEndpoint(endpoint);
    this.credentials = credentials;
    this.apiKey = apiKey;
    this.signer = new AWS4Signer();
    this.signer.setServiceName(API_GATEWAY_SERVICE_NAME);
    this.signer.setRegionName(region.getName());

    final JsonOperationMetadata metadata = new JsonOperationMetadata().withHasStreamingSuccessResponse(false).withPayloadJson(false);
    final Unmarshaller<GenericApiGatewayResponse, JsonUnmarshallerContext> responseUnmarshaller = in -> new GenericApiGatewayResponse(in.getHttpResponse());
    this.responseHandler = SdkStructuredPlainJsonFactory.SDK_JSON_FACTORY.createResponseHandler(metadata, responseUnmarshaller);
    JsonErrorUnmarshaller defaultErrorUnmarshaller = new JsonErrorUnmarshaller(GenericApiGatewayException.class, null) {
        @Override
        public AmazonServiceException unmarshall(JsonNode jsonContent) throws Exception {
            return new GenericApiGatewayException(jsonContent.toString());
        }
    };
    this.errorResponseHandler = SdkStructuredPlainJsonFactory.SDK_JSON_FACTORY.createErrorResponseHandler(
            Collections.singletonList(defaultErrorUnmarshaller), null);

    if (httpClient != null) {
        super.client = httpClient;
    }
}

@Test
public void testBuild_happy() throws Exception {
    AWSCredentialsProvider credentials = new AWSStaticCredentialsProvider(new BasicAWSCredentials("foo", "bar"));

    GenericApiGatewayClient client = new GenericApiGatewayClientBuilder()
            .withClientConfiguration(new ClientConfiguration())
            .withCredentials(credentials)
            .withEndpoint("https://foobar.execute-api.us-east-1.amazonaws.com")
            .withRegion(Region.getRegion(Regions.fromName("us-east-1")))
            .withApiKey("12345")
            .build();

    Assert.assertEquals("Wrong service name","execute-api", client.getServiceNameIntern());
}

@Bean
public AmazonKinesisAsync amazonKinesis(AWSCredentialsProvider awsCredentialsProvider,
        RegionProvider regionProvider) {

    return AmazonKinesisAsyncClientBuilder.standard()
            .withCredentials(awsCredentialsProvider)
            .withRegion(
                    regionProvider.getRegion()
                            .getName())
            .build();
}

@Before
public void setup() {
  EndpointConfiguration endpoint =
      new EndpointConfiguration(UNIT_STACK_URL + ":" + SNS_PORT, Region.EU_Frankfurt.name());
  AWSCredentials credentials = new BasicAWSCredentials("key", "secret");
  AWSCredentialsProvider credentialsProvider = new AWSStaticCredentialsProvider(credentials);

  sns = AmazonSNSAsyncClientBuilder.standard().withEndpointConfiguration(endpoint)
      .withCredentials(credentialsProvider).build();
}

@Before
public void setup() {
  MockParameters params = new MockParameters();
  params.setMockRegion("EU");
  mockS3(params);

  EndpointConfiguration endpoint =
      new EndpointConfiguration(UNIT_STACK_URL + ":" + S3_PORT, Region.EU_Frankfurt.name());
  AWSCredentials credentials = new BasicAWSCredentials("key", "secret");
  AWSCredentialsProvider credentialsProvider = new AWSStaticCredentialsProvider(credentials);

  s3 = AmazonS3ClientBuilder.standard().withEndpointConfiguration(endpoint)
      .withCredentials(credentialsProvider).build();
}

public JWTKMSAuthorizer(String region, String jwtDecryptKeyARN, AWSCredentialsProvider credential) {
    AWSKMS kmsClient = AWSKMSClientBuilder.standard()
            .withRegion(region)
            .withCredentials(credential)
            .build();
    KMSDecrypt kmsDecrypt = new KMSDecrypt(kmsClient, Collections.singleton(jwtDecryptKeyARN));
    jwtDecoder = new JWTDecoder(kmsDecrypt);
}

@Builder
private KinesisVideoExample(Regions region,
        String streamName,
        AWSCredentialsProvider credentialsProvider,
        InputStream inputVideoStream) {
    super(region, credentialsProvider, streamName);
    final AmazonKinesisVideoClientBuilder builder = AmazonKinesisVideoClientBuilder.standard();
    configureClient(builder);
    this.amazonKinesisVideo = builder.build();
    this.inputStream = inputVideoStream;
    this.executorService = Executors.newFixedThreadPool(2);
}

public DynamoDB(AmazonDynamoDB dynamoDBClient,
                AWSCredentialsProvider awsCredentials,
                ClientConfiguration clientConfiguration,
                SecretsGroupIdentifier groupIdentifier,
                ReadWriteLock readWriteLock) {
    super(dynamoDBClient, awsCredentials, clientConfiguration, groupIdentifier, RawSecretEntry.class, Config.converters, readWriteLock);
}

public static DynamoDB fromCredentials(AWSCredentialsProvider awsCredentials,
                                       ClientConfiguration clientConfiguration,
                                       SecretsGroupIdentifier groupIdentifier,
                                       ReadWriteLock readWriteLock) {
    AmazonDynamoDB client = AmazonDynamoDBClientBuilder.standard()
        .withCredentials(awsCredentials)
        .withClientConfiguration(verifyOrThrow(transformAndVerifyOrThrow(clientConfiguration)))
        .withRegion(groupIdentifier.region.getName())
        .build();
    return new DynamoDB(client, awsCredentials, clientConfiguration, groupIdentifier, readWriteLock);
}

public static String getAccount(AWSCredentialsProvider awsCredentialsProvider, ClientConfiguration clientConfiguration) {
    AWSSecurityTokenService client = AWSSecurityTokenServiceClientBuilder.standard()
        .withCredentials(awsCredentialsProvider)
        .withClientConfiguration(transformAndVerifyOrThrow(clientConfiguration))
        .withRegion(RegionResolver.getRegion())
        .build();
    GetCallerIdentityRequest request = new GetCallerIdentityRequest();
    GetCallerIdentityResult result = client.getCallerIdentity(request);

    return result.getAccount();
}

/**
 * @param cryptoConfig a read-only copy of the crypto configuration
 */
S3CryptoModuleEO(AWSKMS kms, S3Direct s3,
                 AWSCredentialsProvider credentialsProvider,
                 EncryptionMaterialsProvider encryptionMaterialsProvider,
                 CryptoConfiguration cryptoConfig) {
    super(kms, s3, credentialsProvider, encryptionMaterialsProvider,
            cryptoConfig);
    if (cryptoConfig.getCryptoMode() != EncryptionOnly)
        throw new IllegalArgumentException();
}

public static KMSEncryptor fromCredentials(AWSCredentialsProvider awsCredentials,
                                           ClientConfiguration clientConfiguration,
                                           SecretsGroupIdentifier groupIdentifier,
                                           EncryptionStrength encryptionStrength) {
    KMSManager manager = KMSManager.fromCredentials(awsCredentials, clientConfiguration, groupIdentifier);
    return new KMSEncryptor(manager, awsCredentials, clientConfiguration, groupIdentifier, new AwsCrypto(), encryptionStrength);
}

public KMSManager(AWSKMS client, AWSCredentialsProvider awsCredentials, ClientConfiguration clientConfiguration, SecretsGroupIdentifier groupIdentifier) {
    this.kms = client;
    this.awsCredentials = awsCredentials;
    this.clientConfiguration = clientConfiguration;
    this.group = groupIdentifier;

    RegionLocalResourceName resourceName = new RegionLocalResourceName(groupIdentifier);
    this.aliasKeyName = ALIAS_PREFIX + resourceName.toString();
}

public static KMSManager fromCredentials(AWSCredentialsProvider awsCredentials,
                                         ClientConfiguration clientConfiguration,
                                         SecretsGroupIdentifier groupIdentifier) {
    AWSKMS client = AWSKMSClientBuilder.standard()
        .withCredentials(awsCredentials)
        .withClientConfiguration(transformAndVerifyOrThrow(clientConfiguration))
        .withRegion(groupIdentifier.region.getName())
        .build();
    return new KMSManager(client, awsCredentials, clientConfiguration, groupIdentifier);
}