AwsKmsCryptographicMaterialsProvider Design/Behavior Improvements about aws-dynamodb-encryption-python

[lavaleri]

Related Java Issue: aws/aws-dynamodb-encryption-java#151

[nappelson]

Thanks @lavaleri - do you have any suggestions for us while using the library in its current state to enforce the key_id? Is there some further validation we could do?

[lavaleri]

Hi @nappelson,

Unfortunately there isn't a workaround to enforce the use of a key_id in the current release. While we do have plans to provide a CryptographicMaterialsProvider that performs the behavior you want, we do not have a timeline we can share for its release.

CryptographicMaterialsProviders were designed as a point of custom configuration to suite customer's key management needs. If it is necessary for you to have this behavior now, you may implement your own CryptographicMaterialsProvider which does the same thing as your changes in #171, and use that in your application. However, if you go this route you will not pick up any future improvements we make to AwsKmsCryptographicMaterialsProvider, and we cannot guarantee a smooth migration to new or upgraded CryptographicMaterialsProviders we may provide in the future.