confidant_client/__init__.py
def _get_keys_and_encrypted_pairs(
            self,
            blind_keys,
            context,
            credential_pairs,
            cipher_type,
            cipher_version
            ):
        """
        Get data keys and encrypted credential_pairs.

        Given a region => kms key dict of blind keys, a region => context dict
        of KMS encryption context, a dict of credential pairs, a cipher and a
        cipher version, generate a dict of region => data keys and a dict of
        region => encrypted credential_pairs and return both in a tuple.
        """
        data_keys = {}
        _credential_pairs = {}
        for region, blind_key in six.iteritems(blind_keys):
            if self.aws_creds:
                session = confidant_client.services.get_boto_session(
                    region=region,
                    aws_access_key_id=self.aws_creds['AccessKeyId'],
                    aws_secret_access_key=self.aws_creds['SecretAccessKey'],
                    aws_session_token=self.aws_creds['SessionToken']
                )
            else:
                session = confidant_client.services.get_boto_session(
                    region=region
                )
            _kms = session.client('kms')
            data_key = cryptolib.create_datakey(
                context[region],
                blind_key,
                _kms
            )
            data_keys[region] = base64.b64encode(
                ensure_bytes(data_key['ciphertext'])
            ).decode('ascii')
            # TODO: this crypto code needs to come from a library. Right now we
            # only support fernet and cipher_version 2, so we're hardcoding it
            # and ignoring the arguments.
            f = Fernet(data_key['plaintext'])
            # For paranoia sake, let's purposely purge plaintext from the
            # data_key, incase someone decides later to include the data_key
            # directly into the return.
            del data_key['plaintext']
            _credential_pairs[region] = f.encrypt(
                json.dumps(credential_pairs).encode('utf-8')
            ).decode('ascii')
        return data_keys, _credential_pairs

        Get data keys and encrypted credential_pairs.

        Given a region => kms key dict of blind keys, a region => context dict
        of KMS encryption context, a dict of credential pairs, a cipher and a
        cipher version, generate a dict of region => data keys and a dict of
        region => encrypted credential_pairs and return both in a tuple.
        
Get data keys and encrypted credential_pairs.
Given a region => kms key dict of blind keys, a region => context dict
of KMS encryption context, a dict of credential pairs, a cipher and a
cipher version, generate a dict of region => data keys and a dict of
region => encrypted credential_pairs and return both in a tuple.
Get data keys and encrypted credential_pairs . Given a region = > kms key dict of blind keys a region = > context dict of KMS encryption context a dict of credential pairs a cipher and a cipher version generate a dict of region = > data keys and a dict of region = > encrypted credential_pairs and return both in a tuple .
def _get_keys_and_encrypted_pairs(
            self,
            blind_keys,
            context,
            credential_pairs,
            cipher_type,
            cipher_version
            ):
        data_keys = {}
        _credential_pairs = {}
        for region, blind_key in six.iteritems(blind_keys):
            if self.aws_creds:
                session = confidant_client.services.get_boto_session(
                    region=region,
                    aws_access_key_id=self.aws_creds['AccessKeyId'],
                    aws_secret_access_key=self.aws_creds['SecretAccessKey'],
                    aws_session_token=self.aws_creds['SessionToken']
                )
            else:
                session = confidant_client.services.get_boto_session(
                    region=region
                )
            _kms = session.client('kms')
            data_key = cryptolib.create_datakey(
                context[region],
                blind_key,
                _kms
            )
            data_keys[region] = base64.b64encode(
                ensure_bytes(data_key['ciphertext'])
            ).decode('ascii')
            f = Fernet(data_key['plaintext'])
            del data_key['plaintext']
            _credential_pairs[region] = f.encrypt(
                json.dumps(credential_pairs).encode('utf-8')
            ).decode('ascii')
        return data_keys, _credential_pairs
def _get_keys_and_encrypted_pairs ( self , blind_keys , context , credential_pairs , cipher_type , cipher_version ) : data_keys = { } _credential_pairs = { } for region , blind_key in six . iteritems ( blind_keys ) : if self . aws_creds : session = confidant_client . services . get_boto_session ( region = region , aws_access_key_id = self . aws_creds [ 'AccessKeyId' ] , aws_secret_access_key = self . aws_creds [ 'SecretAccessKey' ] , aws_session_token = self . aws_creds [ 'SessionToken' ] ) else : session = confidant_client . services . get_boto_session ( region = region ) _kms = session . client ( 'kms' ) data_key = cryptolib . create_datakey ( context [ region ] , blind_key , _kms ) data_keys [ region ] = base64 . b64encode ( ensure_bytes ( data_key [ 'ciphertext' ] ) ) . decode ( 'ascii' ) f = Fernet ( data_key [ 'plaintext' ] ) del data_key [ 'plaintext' ] _credential_pairs [ region ] = f . encrypt ( json . dumps ( credential_pairs ) . encode ( 'utf-8' ) ) . decode ( 'ascii' ) return data_keys , _credential_pairs
Get data keys and encrypted credential_pairs.
Get data keys and encrypted credential_pairs .
"""
        Get data keys and encrypted credential_pairs.

        Given a region => kms key dict of blind keys, a region => context dict
        of KMS encryption context, a dict of credential pairs, a cipher and a
        cipher version, generate a dict of region => data keys and a dict of
        region => encrypted credential_pairs and return both in a tuple.
        """ # TODO: this crypto code needs to come from a library. Right now we # only support fernet and cipher_version 2, so we're hardcoding it # and ignoring the arguments. # For paranoia sake, let's purposely purge plaintext from the # data_key, incase someone decides later to include the data_key # directly into the return.
self
blind_keys
context
credential_pairs
cipher_type
cipher_version