Java 类com.amazonaws.services.s3.model.EncryptionMaterialsProvider 实例源码

@Singleton
@Provides
@Nullable
public AmazonS3 provideAmazonS3Client(@Nullable AWSCredentials awsCredentials, @Nullable EncryptionMaterialsProvider encryptionMaterialsProvider)
{
    if (awsCredentials == null) {
        if (encryptionMaterialsProvider == null) {
            return new AmazonS3Client(new InstanceProfileCredentialsProvider());
        }
        else {
            return new AmazonS3EncryptionClient(new InstanceProfileCredentialsProvider(), encryptionMaterialsProvider);
        }
    }

    if (encryptionMaterialsProvider == null) {
        return new AmazonS3Client(awsCredentials);
    }
    else {
        return new AmazonS3EncryptionClient(awsCredentials, encryptionMaterialsProvider);
    }
}

/**
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCredentials(AWSCredentialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCryptoConfiguration(CryptoConfiguration)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withClientConfiguration(ClientConfiguration)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withMetricsCollector(RequestMetricCollector)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withKmsClient(AWSKMS)}
 */
@Deprecated
public AmazonS3EncryptionClient(AWSKMSClient kms,
        AWSCredentialsProvider credentialsProvider,
        EncryptionMaterialsProvider kekMaterialsProvider,
        ClientConfiguration clientConfig,
        CryptoConfiguration cryptoConfig,
        RequestMetricCollector requestMetricCollector) {
    super(credentialsProvider, clientConfig, requestMetricCollector);
    assertParameterNotNull(kekMaterialsProvider,
            "EncryptionMaterialsProvider parameter must not be null.");
    assertParameterNotNull(cryptoConfig,
            "CryptoConfiguration parameter must not be null.");
    this.isKMSClientInternal = kms == null;
    this.kms = isKMSClientInternal 
        ? newAWSKMSClient(credentialsProvider, clientConfig, cryptoConfig, 
                requestMetricCollector)
        : kms;
    this.crypto = new CryptoModuleDispatcher(this.kms, new S3DirectImpl(),
            credentialsProvider, kekMaterialsProvider, cryptoConfig);
}

private static EncryptionMaterialsProvider createEncryptionMaterialsProvider(Configuration hadoopConfig)
{
    String empClassName = hadoopConfig.get(S3_ENCRYPTION_MATERIALS_PROVIDER);
    if (empClassName == null) {
        return null;
    }

    try {
        Object instance = Class.forName(empClassName).getConstructor().newInstance();
        if (!(instance instanceof EncryptionMaterialsProvider)) {
            throw new RuntimeException("Invalid encryption materials provider class: " + instance.getClass().getName());
        }
        EncryptionMaterialsProvider emp = (EncryptionMaterialsProvider) instance;
        if (emp instanceof Configurable) {
            ((Configurable) emp).setConf(hadoopConfig);
        }
        return emp;
    }
    catch (ReflectiveOperationException e) {
        throw new RuntimeException("Unable to load or create S3 encryption materials provider: " + empClassName, e);
    }
}

@Nullable
@Singleton
@Provides
private EncryptionMaterialsProvider provideEncryptionMaterialsProvider()
{
    String empClassName = config.getS3EncryptionMaterialsProvider();
    if (empClassName != null) {
        try {
            Class<?> empClass = Class.forName(empClassName);
            Object instance = empClass.newInstance();
            if (instance instanceof EncryptionMaterialsProvider) {
                return (EncryptionMaterialsProvider) instance;
            }
            else {
                throw new IllegalArgumentException("Class " + empClassName + " must implement EncryptionMaterialsProvider");
            }
        }
        catch (Exception x) {
            throw new RuntimeException("Unable to initialize EncryptionMaterialsProvider class " + empClassName + ": " + x, x);
        }
    }

    return null;
}

AmazonS3EncryptionClientParamsWrapper(AwsSyncClientParams getClientParams,
                                      S3ClientOptions getS3ClientOptions,
                                      EncryptionMaterialsProvider encryptionMaterials,
                                      CryptoConfiguration cryptoConfiguration,
                                      AWSKMS kms) {
    this.encryptionMaterials = encryptionMaterials;
    this.cryptoConfiguration = cryptoConfiguration;
    this.kms = kms;
    this.getClientParams = getClientParams;
    this.getS3ClientOptions = getS3ClientOptions;
}

/**
 * @param cryptoConfig a read-only copy of the crypto configuration.
 */
S3CryptoModuleAEStrict(AWSKMS kms, S3Direct s3,
                       AWSCredentialsProvider credentialsProvider,
                       EncryptionMaterialsProvider encryptionMaterialsProvider,
                       CryptoConfiguration cryptoConfig) {
    super(kms, s3, credentialsProvider, encryptionMaterialsProvider,
            cryptoConfig);
    if (cryptoConfig.getCryptoMode() != StrictAuthenticatedEncryption)
        throw new IllegalArgumentException();
}

/**
 * @param cryptoConfig a read-only copy of the crypto configuration.
 */
protected S3CryptoModuleBase(AWSKMS kms, S3Direct s3,
        AWSCredentialsProvider credentialsProvider,
        EncryptionMaterialsProvider kekMaterialsProvider,
        CryptoConfiguration cryptoConfig) {
    if (!cryptoConfig.isReadOnly())
        throw new IllegalArgumentException("The cryto configuration parameter is required to be read-only");
    this.kekMaterialsProvider = kekMaterialsProvider;
    this.s3 = s3;
    this.cryptoConfig = cryptoConfig;
    this.cryptoScheme = S3CryptoScheme.from(cryptoConfig.getCryptoMode());
    this.contentCryptoScheme = cryptoScheme.getContentCryptoScheme();
    this.kms = kms;
}

/**
 * For testing purposes only.
 */
protected S3CryptoModuleBase(S3Direct s3,
        AWSCredentialsProvider credentialsProvider,
        EncryptionMaterialsProvider kekMaterialsProvider,
        CryptoConfiguration cryptoConfig) {
    this.kekMaterialsProvider = kekMaterialsProvider;
    this.s3 = s3;
    this.cryptoConfig = cryptoConfig;
    this.cryptoScheme = S3CryptoScheme.from(cryptoConfig.getCryptoMode());
    this.contentCryptoScheme = cryptoScheme.getContentCryptoScheme();
    this.kms = null;
}

/**
 * Returns the content encryption material generated with the given kek
 * material, material description and security providers; or null if
 * the encryption material cannot be found for the specified description.
 */
private ContentCryptoMaterial newContentCryptoMaterial(
        EncryptionMaterialsProvider kekMaterialProvider,
        Map<String, String> materialsDescription, Provider provider,
        AmazonWebServiceRequest req) {
    EncryptionMaterials kekMaterials =
        kekMaterialProvider.getEncryptionMaterials(materialsDescription);
    if (kekMaterials == null) {
        return null;
    }
    return buildContentCryptoMaterial(kekMaterials, provider, req);
}

/**
 * Returns a non-null content encryption material generated with the given kek
 * material and security providers.
 *
 * @throws SdkClientException if no encryption material can be found from
 * the given encryption material provider.
 */
private ContentCryptoMaterial newContentCryptoMaterial(
        EncryptionMaterialsProvider kekMaterialProvider,
        Provider provider, AmazonWebServiceRequest req) {
    EncryptionMaterials kekMaterials = kekMaterialProvider.getEncryptionMaterials();
    if (kekMaterials == null)
        throw new SdkClientException("No material available from the encryption material provider");
    return buildContentCryptoMaterial(kekMaterials, provider, req);
}

/**
 * @param cryptoConfig a read-only copy of the crypto configuration
 */
S3CryptoModuleEO(AWSKMS kms, S3Direct s3,
                 AWSCredentialsProvider credentialsProvider,
                 EncryptionMaterialsProvider encryptionMaterialsProvider,
                 CryptoConfiguration cryptoConfig) {
    super(kms, s3, credentialsProvider, encryptionMaterialsProvider,
            cryptoConfig);
    if (cryptoConfig.getCryptoMode() != EncryptionOnly)
        throw new IllegalArgumentException();
}

/**
 * Used for testing purposes only.
 */
S3CryptoModuleEO(S3Direct s3,
        EncryptionMaterialsProvider encryptionMaterialsProvider,
        CryptoConfiguration cryptoConfig) {
    this(null, s3, new DefaultAWSCredentialsProviderChain(),
            encryptionMaterialsProvider, cryptoConfig);
}

/**
 * Used for testing purposes only.
 */
S3CryptoModuleEO(AWSKMS kms, S3Direct s3,
        EncryptionMaterialsProvider encryptionMaterialsProvider,
        CryptoConfiguration cryptoConfig) {
    this(kms, s3, new DefaultAWSCredentialsProviderChain(),
            encryptionMaterialsProvider, cryptoConfig);
}

/**
 * @param cryptoConfig a read-only copy of the crypto configuration.
 */
S3CryptoModuleAE(AWSKMS kms, S3Direct s3,
                 AWSCredentialsProvider credentialsProvider,
                 EncryptionMaterialsProvider encryptionMaterialsProvider,
                 CryptoConfiguration cryptoConfig) {
    super(kms, s3, credentialsProvider, encryptionMaterialsProvider,
            cryptoConfig);
    CryptoMode mode = cryptoConfig.getCryptoMode();
    if (mode != StrictAuthenticatedEncryption
    &&  mode != AuthenticatedEncryption) {
        throw new IllegalArgumentException();
    }
}

/**
 * Used for testing purposes only.
 */
S3CryptoModuleAE(S3Direct s3,
        EncryptionMaterialsProvider encryptionMaterialsProvider,
        CryptoConfiguration cryptoConfig) {
    this(null, s3, new DefaultAWSCredentialsProviderChain(),
            encryptionMaterialsProvider, cryptoConfig);
}

/**
 * Used for testing purposes only.
 */
S3CryptoModuleAE(AWSKMS kms, S3Direct s3,
                 EncryptionMaterialsProvider encryptionMaterialsProvider,
                 CryptoConfiguration cryptoConfig) {
    this(kms, s3, new DefaultAWSCredentialsProviderChain(),
            encryptionMaterialsProvider, cryptoConfig);
}

/**
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCredentials(AWSCredentialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCryptoConfiguration(CryptoConfiguration)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withClientConfiguration(ClientConfiguration)}
 */
@Deprecated
public AmazonS3EncryptionClient(AWSCredentials credentials,
        EncryptionMaterialsProvider encryptionMaterialsProvider,
        ClientConfiguration clientConfig, CryptoConfiguration cryptoConfig) {
    this(new StaticCredentialsProvider(credentials),
            encryptionMaterialsProvider, clientConfig, cryptoConfig);
}

/**
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCredentials(AWSCredentialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCryptoConfiguration(CryptoConfiguration)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withClientConfiguration(ClientConfiguration)}
 */
@Deprecated
public AmazonS3EncryptionClient(
        AWSCredentialsProvider credentialsProvider,
        EncryptionMaterialsProvider kekMaterialsProvider,
        ClientConfiguration clientConfig,
        CryptoConfiguration cryptoConfig) {
    this(credentialsProvider, kekMaterialsProvider, clientConfig,
            cryptoConfig,
            null    // request metric collector
    );
}

/**
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCredentials(AWSCredentialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCryptoConfiguration(CryptoConfiguration)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withClientConfiguration(ClientConfiguration)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withMetricsCollector(RequestMetricCollector)}
 */
@Deprecated
public AmazonS3EncryptionClient(
        AWSCredentialsProvider credentialsProvider,
        EncryptionMaterialsProvider kekMaterialsProvider,
        ClientConfiguration clientConfig,
        CryptoConfiguration cryptoConfig,
        RequestMetricCollector requestMetricCollector) {
    this(null, // KMS client
        credentialsProvider, kekMaterialsProvider, clientConfig,
        cryptoConfig, requestMetricCollector);
}

@Override
EncryptionMaterialsProvider getEncryptionMaterials() {
    return encryptionMaterials;
}

public CryptoModuleDispatcher(AWSKMS kms, S3Direct s3,
                              AWSCredentialsProvider credentialsProvider,
                              EncryptionMaterialsProvider encryptionMaterialsProvider,
                              CryptoConfiguration cryptoConfig) {
    cryptoConfig = cryptoConfig.clone();    // make a clone
    CryptoMode cryptoMode = cryptoConfig.getCryptoMode();
    if (cryptoMode == null) {
        cryptoMode = EncryptionOnly;
        cryptoConfig.setCryptoMode(cryptoMode); // defaults to EO
    }
    cryptoConfig = cryptoConfig.readOnly(); // make read-only
    this.defaultCryptoMode = cryptoConfig.getCryptoMode();
    switch(this.defaultCryptoMode) {
        case StrictAuthenticatedEncryption:
            this.ae = new S3CryptoModuleAEStrict(kms, s3, credentialsProvider,
                    encryptionMaterialsProvider,
                    cryptoConfig);
            this.eo = null;
            break;
        case AuthenticatedEncryption:
            this.ae = new S3CryptoModuleAE(kms, s3, credentialsProvider,
                    encryptionMaterialsProvider,
                    cryptoConfig);
            this.eo = null;
            break;
        case EncryptionOnly:
            this.eo = new S3CryptoModuleEO(kms, s3, credentialsProvider,
                    encryptionMaterialsProvider,
                    cryptoConfig);
            CryptoConfiguration aeConfig = cryptoConfig.clone();
            try {
                aeConfig.setCryptoMode(AuthenticatedEncryption);
            } catch(UnsupportedOperationException ex) {
                // BC not available during runtime; but EO can still work.
                // Hence ignoring.
            }
            this.ae = new S3CryptoModuleAE(kms, s3, credentialsProvider,
                encryptionMaterialsProvider,
                aeConfig.readOnly());
            break;
        default:
            throw new IllegalStateException();
    }
}

/**
 * <p>
 * Constructs a new Amazon S3 Encryption client that will make <b>anonymous</b>
 * requests to Amazon S3.  If {@link #getObject(String, String)} is called,
 * the object contents will be decrypted with the encryption materials provided.
 * </p>
 * <p>
 * Only a subset of the Amazon S3 API will work with anonymous
 * <i>(i.e. unsigned)</i> requests, but this can prove useful in some situations.
 * For example:
 * <ul>
 *  <li>If an Amazon S3 bucket has {@link Permission#Read} permission for the
 *  {@link GroupGrantee#AllUsers} group, anonymous clients can call
 *  {@link #listObjects(String)} to see what objects are stored in a bucket.</li>
 *  <li>If an object has {@link Permission#Read} permission for the
 *  {@link GroupGrantee#AllUsers} group, anonymous clients can call
 *  {@link #getObject(String, String)} and
 *  {@link #getObjectMetadata(String, String)} to pull object content and
 *  metadata.</li>
 *  <li>If a bucket has {@link Permission#Write} permission for the
 *  {@link GroupGrantee#AllUsers} group, anonymous clients can upload objects
 *  to the bucket.</li>
 * </ul>
 * </p>
 *
 * @param encryptionMaterialsProvider
 *            A provider for the encryption materials to be used to encrypt and decrypt data.
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)}
 */
@Deprecated
public AmazonS3EncryptionClient(
        EncryptionMaterialsProvider encryptionMaterialsProvider) {

    this(new StaticCredentialsProvider(new AnonymousAWSCredentials()),
            encryptionMaterialsProvider,
            configFactory.getConfig(), new CryptoConfiguration());
}

/**
 * <p>
 * Constructs a new Amazon S3 Encryption client that will make <b>anonymous</b>
 * requests to Amazon S3.  If {@link #getObject(String, String)} is called,
 * the object contents will be decrypted with the encryption materials provided.
 * The encryption implementation of the provided crypto provider will be
 * used to encrypt and decrypt data.
 * </p>
 * <p>
 * Only a subset of the Amazon S3 API will work with anonymous
 * <i>(i.e. unsigned)</i> requests, but this can prove useful in some situations.
 * For example:
 * <ul>
 *  <li>If an Amazon S3 bucket has {@link Permission#Read} permission for the
 *  {@link GroupGrantee#AllUsers} group, anonymous clients can call
 *  {@link #listObjects(String)} to see what objects are stored in a bucket.</li>
 *  <li>If an object has {@link Permission#Read} permission for the
 *  {@link GroupGrantee#AllUsers} group, anonymous clients can call
 *  {@link #getObject(String, String)} and
 *  {@link #getObjectMetadata(String, String)} to pull object content and
 *  metadata.</li>
 *  <li>If a bucket has {@link Permission#Write} permission for the
 *  {@link GroupGrantee#AllUsers} group, anonymous clients can upload objects
 *  to the bucket.</li>
 * </ul>
 * </p>
 *
 * @param encryptionMaterialsProvider
 *            A provider for the encryption materials to be used to encrypt and decrypt data.
 * @param cryptoConfig
 *            The crypto configuration whose parameters will be used to encrypt and decrypt data.
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCryptoConfiguration(CryptoConfiguration)}
 */
@Deprecated
public AmazonS3EncryptionClient(
        EncryptionMaterialsProvider encryptionMaterialsProvider,
        CryptoConfiguration cryptoConfig) {

    this(new StaticCredentialsProvider(new AnonymousAWSCredentials()),
            encryptionMaterialsProvider,
            configFactory.getConfig(), cryptoConfig);
}

/**
 * <p>
 * Constructs a new Amazon S3 Encryption client using the specified AWS credentials to
 * access Amazon S3.  Object contents will be encrypted and decrypted with the encryption
 * materials provided.
 * </p>
 *
 * @param credentials
 *            The AWS credentials to use when making requests to Amazon S3
 *            with this client.
 * @param encryptionMaterialsProvider
 *            A provider for the encryption materials to be used to encrypt and decrypt data.
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCredentials(AWSCredentialsProvider)}
 */
@Deprecated
public AmazonS3EncryptionClient(AWSCredentials credentials,
        EncryptionMaterialsProvider encryptionMaterialsProvider) {
    this(credentials, encryptionMaterialsProvider,
            configFactory.getConfig(), new CryptoConfiguration());
}

/**
 * <p>
 * Constructs a new Amazon S3 Encryption client using the specified AWS credentials to
 * access Amazon S3.  Object contents will be encrypted and decrypted with the encryption
 * materials provided.
 * </p>
 *
 * @param credentialsProvider
 *            The AWS credentials provider which will provide credentials
 *            to authenticate requests with AWS services.
 * @param encryptionMaterialsProvider
 *            A provider for the encryption materials to be used to encrypt and decrypt data.
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCredentials(AWSCredentialsProvider)}
 */
@Deprecated
public AmazonS3EncryptionClient(
        AWSCredentialsProvider credentialsProvider,
        EncryptionMaterialsProvider encryptionMaterialsProvider) {
    this(credentialsProvider, encryptionMaterialsProvider,
            configFactory.getConfig(), new CryptoConfiguration());
}

/**
 * <p>
 * Constructs a new Amazon S3 Encryption client using the specified AWS credentials to
 * access Amazon S3.  Object contents will be encrypted and decrypted with the encryption
 * materials provided.  The encryption implementation of the provided crypto provider will
 * be used to encrypt and decrypt data.
 * </p>
 *
 * @param credentials
 *            The AWS credentials to use when making requests to Amazon S3
 *            with this client.
 * @param encryptionMaterialsProvider
 *            A provider for the encryption materials to be used to encrypt and decrypt data.
 * @param cryptoConfig
 *            The crypto configuration whose parameters will be used to encrypt and decrypt data.
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCredentials(AWSCredentialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCryptoConfiguration(CryptoConfiguration)}
 */
@Deprecated
public AmazonS3EncryptionClient(AWSCredentials credentials,
        EncryptionMaterialsProvider encryptionMaterialsProvider,
        CryptoConfiguration cryptoConfig) {
    this(credentials, encryptionMaterialsProvider,
            configFactory.getConfig(), cryptoConfig);
}

/**
 * <p>
 * Constructs a new Amazon S3 Encryption client using the specified AWS credentials to
 * access Amazon S3.  Object contents will be encrypted and decrypted with the encryption
 * materials provided.  The encryption implementation of the provided crypto provider will
 * be used to encrypt and decrypt data.
 * </p>
 *
 * @param credentialsProvider
 *            The AWS credentials provider which will provide credentials
 *            to authenticate requests with AWS services.
 * @param encryptionMaterialsProvider
 *            A provider for the encryption materials to be used to encrypt and decrypt data.
 * @param cryptoConfig
 *            The crypto configuration whose parameters will be used to encrypt and decrypt data.
 * @deprecated use {@link AmazonS3EncryptionClientBuilder#withEncryptionMaterials(EncryptionMaterialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCredentials(AWSCredentialsProvider)} and
 *                 {@link AmazonS3EncryptionClientBuilder#withCryptoConfiguration(CryptoConfiguration)}
 */
@Deprecated
public AmazonS3EncryptionClient(
        AWSCredentialsProvider credentialsProvider,
        EncryptionMaterialsProvider encryptionMaterialsProvider,
        CryptoConfiguration cryptoConfig) {
    this(credentialsProvider, encryptionMaterialsProvider,
            configFactory.getConfig(), cryptoConfig);
}

/**
 * Sets the encryption materials to be used to encrypt and decrypt data
 * @param encryptionMaterials a provider for the encryption materials
 */
public void setEncryptionMaterials(EncryptionMaterialsProvider encryptionMaterials) {
    this.encryptionMaterials = encryptionMaterials;
}

/**
 * Sets the encryption materials to be used to encrypt and decrypt data
 * @param encryptionMaterials A provider for the encryption materials to be used to encrypt and decrypt data.
 * @return this object for method chaining
 */
public AmazonS3EncryptionClientBuilder withEncryptionMaterials(EncryptionMaterialsProvider encryptionMaterials) {
    setEncryptionMaterials(encryptionMaterials);
    return this;
}

abstract EncryptionMaterialsProvider getEncryptionMaterials();