KMS: Add list-key-rotations flag #12853
Conversation
There was a problem hiding this comment.
Welcome to LocalStack! Thanks for raising your first Pull Request and landing in your contributions. Our team will reach out with any reviews or feedbacks that we have shortly. We recommend joining our Slack Community and share your PR on the #community channel to share your contributions with us. Please make sure you are following our contributing guidelines and our Code of Conduct.
|
All contributors have signed the CLA ✍️ ✅ |
|
I have read the CLA Document and I hereby sign the CLA |
viren-nadkarni
added
the
semver: minor
demaj
force-pushed
the
kms-add-list-key-rotations
branch
from
6570477 to
fd7df95
Compare
| f"failed to satisfy constraint: Member must satisfy enum value set: [ALL_KEY_MATERIAL, ROTATIONS_ONLY]" | ||
| ) | ||
|
|
||
| if key.metadata["KeySpec"] != KeySpec.SYMMETRIC_DEFAULT: |
There was a problem hiding this comment.
As per AWS docs, for asymmetric keys when IncludeKeyMaterial is not provided we simply return the Rotations as empty [].
See here: https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-compare.html#key-type-table
| if include_key_material == IncludeKeyMaterial.ALL_KEY_MATERIAL: | ||
| rotation_history.append(rotation_entry) | ||
| else: # Default ROTATIONS_ONLY | ||
| if rotation.rotation_type in ["AUTOMATIC", "ON_DEMAND"]: |
There was a problem hiding this comment.
A KMS key on its creation doesn't have any rotation_type.
| initial_rotation = KeyRotationEntry( | ||
| key_id=self.metadata["Arn"], | ||
| key_material_state="CURRENT", | ||
| key_material_id=long_uid(), # FIXME: a more appropriate KMS output |
There was a problem hiding this comment.
Currently relying on uuid, open to suggestions.
There was a problem hiding this comment.
I'm getting "Truncated": false here. Not entirely sure why it's being included, I do not see it on my awscli output; there is a discrepancy between AWS Docs and AWS CLI.
Removed them manually from this file (I know we're not supposed to manually edit it). Let me know if I should re-add it and make changes on the function's response payload.
Motivation
Adding support for ListKeyRotations. Mentioned in #12342.
Changes
Implementation of list-key-rotations feature for keys that may have multiple key materials associated with them.
As per AWS's, list-key-rotation is only allowed for:
TODO
What's left to do: