Add KMS ReEncrypt Operation #12637

victor-martin-santiago · 2025-05-19T08:19:12Z

Motivation

I'm creating this PR to add the implementation for the KMS ReEncrypt operation.

Changes

Adds an implementation for KMS ReEncrypt operation, based on the already existing Encrypt and Decrypt operations,

Testing

The changes have been covered by integration & AWS parity tests.

Optionally, the ReEncrypt operation can be tested using the below aws cli command

aws kms re-encrypt \
	--endpoint-ur=http://localhost:4566 \
	--ciphertext-blob="$encriptedText" \
	--destination-key-id=$destinationKeyId \
	--source-key-id=$sourceKeyId

test: first re-encrypt integration test

localstack-bot · 2025-05-19T08:19:23Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

localstack-bot

Welcome to LocalStack! Thanks for raising your first Pull Request and landing in your contributions. Our team will reach out with any reviews or feedbacks that we have shortly. We recommend joining our Slack Community and share your PR on the #community channel to share your contributions with us. Please make sure you are following our contributing guidelines and our Code of Conduct.

victor-martin-santiago · 2025-05-19T10:20:23Z

I have read the CLA Document and I hereby sign the CLA

victor-martin-santiago · 2025-05-19T10:20:44Z

recheck

viren-nadkarni

Thanks for raising the PR!

It looks good overall, I have only some small points

viren-nadkarni · 2025-05-20T08:06:50Z

localstack-core/localstack/services/kms/provider.py

@@ -954,8 +954,29 @@ def re_encrypt(
        dry_run: NullableBooleanType = None,
        **kwargs,
    ) -> ReEncryptResponse:
-        # TODO: when implementing, ensure cross-account support for source_key_id and destination_key_id


Please leave this TODO comment, it will help future multi-accounts work

TODO restored

viren-nadkarni · 2025-05-20T10:40:09Z

tests/aws/services/kms/test_kms.py

+        ],
+    )
+    @markers.aws.validated
+    def test_re_encript(self, kms_create_key, key_spec, algo, aws_client):


Nitpick: typo

Suggested change

def test_re_encript(self, kms_create_key, key_spec, algo, aws_client):

def test_re_encrypt(self, kms_create_key, key_spec, algo, aws_client):

viren-nadkarni · 2025-05-20T10:41:39Z

tests/aws/services/kms/test_kms.snapshot.json

+          "HTTPStatusCode": 200
+        }
+      }
+    }


This file is generated by the snapshot fixture, but it's not used in the test.

Could you have mistakenly removed it?

Yes, I removed the snapshot check by mistake during one of my tests. It's been restored.

sannya-singal

Great work on implementing the ReEncrypt operation for KMS! 🚀

I just have few suggestions to further enhance the parity with AWS by adding a check for verifying the KeyUsage. Once that’s in place, we can do a quick re-review and move forward with merging the PR 🎉 Thank you 🙌

sannya-singal · 2025-05-21T03:52:04Z

tests/aws/services/kms/test_kms.validation.json

+  "tests/aws/services/kms/test_kms.py::TestKMS::test_re_encript[RSA_2048-RSAES_OAEP_SHA_256]": {
+    "last_validated_date": "2025-05-19T07:54:40+00:00"
+  },
+  "tests/aws/services/kms/test_kms.py::TestKMS::test_re_encript[SYMMETRIC_DEFAULT-SYMMETRIC_DEFAULT]": {
+    "last_validated_date": "2025-05-19T07:54:39+00:00"
+  },


comment: Probably a leftover from testing, we should remove this.

You are right, it's been removed.

sannya-singal · 2025-05-21T04:12:39Z

localstack-core/localstack/services/kms/provider.py

+        account_id, region_name, source_key_id = self._parse_key_id(source_key_id, context)
+        source_key = self._get_kms_key(account_id, region_name, source_key_id)
+        # Decrypt using source key
+        decrypt_response = self.decrypt(


suggestion: It would be great to add a check to ensure that both the source and destination keys have KeyUsage set to ENCRYPT_DECRYPT.

This aligns with AWS KMS behaviour, which restricts ReEncrypt, Encrypt, and Decrypt operations to keys explicitly configured for encryption and decryption. Attempting to use invalid keys with other usages should raise an exception similar to AWS.

Adding this validation would improve spec compliance and provide clearer feedback to users if they accidentally use a key with an incompatible purpose.

Let me know if you'd like help drafting the validation logic or a corresponding test case!

Thank you for your review @sannya-singal. That sounds like a good idea 😁. I'll get that pushed throughout the day.

Regarding the validation @sannya-singal

When looking at the code again, I realised the KeyUsage check already happens in both the Encrypt and Decrypt operations. So I think adding the check again before the invocation would be redundant.

On the other hand, I've added tests for these two scenarios as I didn't find any for the already existing Encrypt and Decrypt operations. However, two remarks:

test_re_encrypt_incorrect_source_key: Since the cipher text's key is verified before validating the key usage, I could only test for IncorrectKeyException. Unsure if there's another way to test for InvalidKeyUsageException.

test_re_encrypt_invalid_destination_key : I had to disable the snapshot check as I'm not quite sure where the ReEncryptTo operation name is coming from.

Thank you!

… source/destination keys are provided

victor-martin-santiago added 3 commits May 15, 2025 21:30

feat: implement kms re-encrypt operation

635e449

test: first re-encrypt integration test

Backmerge from master

0a5499f

test: record snapshot and set the test as aws validated

b5e699c

localstack-bot reviewed May 19, 2025

View reviewed changes

victor-martin-santiago changed the title ~~Add KMS Re-encrypt Operation~~ Add KMS ReEncrypt Operation May 19, 2025

victor-martin-santiago added 6 commits May 19, 2025 10:27

fix: remove whitelines

3275f29

fix: remove white space

6b0d3f9

fix: remove whitespace

d69f6ec

fix: linting

cb32a21

fix: lint tests

0ff104a

fix: lint, remove extra blank line

19bd2c1

victor-martin-santiago marked this pull request as ready for review May 19, 2025 09:38

victor-martin-santiago requested a review from sannya-singal as a code owner May 19, 2025 09:38

localstack-bot added a commit that referenced this pull request May 19, 2025

@victormartinsantiago has signed the CLA in #12637

ff9becf

viren-nadkarni added the semver: minor Non-breaking changes which can be included in minor releases, but not in patch releases label May 19, 2025

viren-nadkarni self-requested a review May 20, 2025 08:05

viren-nadkarni assigned victor-martin-santiago May 20, 2025

viren-nadkarni reviewed May 20, 2025

View reviewed changes

victor-martin-santiago added 4 commits May 20, 2025 15:02

fix: parse source and destination keys to retrieve arn

baa3838

fix: linter

12e2edf

fix: lint

475fc86

chore: update comments

3571777

sannya-singal reviewed May 21, 2025

View reviewed changes

victor-martin-santiago added 3 commits May 21, 2025 14:49

test: add tests to verify that an exception is raised when an invalid…

3285936

… source/destination keys are provided

fix: lint

4f8742b

fix: lint

6643632

	def test_re_encript(self, kms_create_key, key_spec, algo, aws_client):
	def test_re_encrypt(self, kms_create_key, key_spec, algo, aws_client):

Uh oh!

Add KMS ReEncrypt Operation #12637

Are you sure you want to change the base?

Add KMS ReEncrypt Operation #12637

Uh oh!

Conversation

victor-martin-santiago commented May 19, 2025

Motivation

Changes

Testing

Uh oh!

localstack-bot commented May 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

localstack-bot left a comment

Choose a reason for hiding this comment

Uh oh!

victor-martin-santiago commented May 19, 2025

Uh oh!

victor-martin-santiago commented May 19, 2025

Uh oh!

viren-nadkarni left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sannya-singal left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

victor-martin-santiago May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

localstack-bot commented May 19, 2025 •

edited

Loading

victor-martin-santiago May 21, 2025 •

edited

Loading