Merge branch 'master' into fix-parsed-ciphertext-test

aws · Jan 27, 2021 · 58bea6d · 58bea6d
2 parents 850a873 + ca03d79
commit 58bea6d
Showing 1 changed file with 18 additions and 4 deletions.
diff --git a/src/main/java/com/amazonaws/encryptionsdk/kms/KmsMasterKeyProvider.java b/src/main/java/com/amazonaws/encryptionsdk/kms/KmsMasterKeyProvider.java
@@ -245,11 +245,18 @@ public KmsMasterKeyProvider buildDiscovery(DiscoveryFilter filter) {
 
         /**
          * Builds the master key provider in Strict Mode.
-         * KMS Master Key Providers in Strict Mode will only attempt to decrypt using the
-         * keys listed in {@code keyIds}.
+         * KMS Master Key Providers in Strict Mode will only attempt to decrypt using
+         * key ARNs listed in {@code keyIds}.
          * KMS Master Key Providers in Strict Mode will encrypt data keys using the keys
          * listed in {@code keyIds}
          *
+         * In Strict Mode, one or more CMKs must be provided.
+         * For providers that will only be used for encryption,
+         * you can use any valid KMS key identifier.
+         * For providers that will be used for decryption,
+         * you must use the key ARN;
+         * key ids, alias names, and alias ARNs are not supported.
+         *
          * @param keyIds
          * @return
          */
@@ -267,11 +274,18 @@ public KmsMasterKeyProvider buildStrict(List<String> keyIds) {
 
         /**
          * Builds the master key provider in strict mode.
-         * KMS Master Key Providers in Strict Mode will only attempt to decrypt using the
-         * keys listed in {@code keyIds}.
+         * KMS Master Key Providers in Strict Mode will only attempt to decrypt using
+         * key ARNs listed in {@code keyIds}.
          * KMS Master Key Providers in Strict Mode will encrypt data keys using the keys
          * listed in {@code keyIds}
          *
+         * In Strict Mode, one or more CMKs must be provided.
+         * For providers that will only be used for encryption,
+         * you can use any valid KMS key identifier.
+         * For providers that will be used for decryption,
+         * you must use the key ARN;
+         * key ids, alias names, and alias ARNs are not supported.
+         *
          * @param keyIds
          * @return
          */