Method createBucketKey

lib/kms/wrapper.js:187–222

* Create a new bucket encryption key. * * This function is responsible for creating an encryption key for a bucket. * If the client supports using a default master encryption key per account * and one is configured, the key is managed at the account level by Vault. * Ot

(bucket, log, cb)

      * @callback called with (err, { masterKeyId: string, masterKeyArn: string, isAccountEncryptionEnabled: boolean })
      */
    static createBucketKey(bucket, log, cb) {
        // always use current client for create
        log.debug('creating a new bucket key');
        // Check if the client supports the use of a default master encryption key per account
        // and one is configured.
        // If so, retrieve or create the encryption key for the account from Vault.
        // Later its id will be stored at the bucket metadata level.
        if (client.supportsDefaultKeyPerAccount && config.defaultEncryptionKeyPerAccount) {
            return vault.getOrCreateEncryptionKeyId(bucket.getOwner(), log, (err, data) => {
                if (err) {
                    log.debug('error retrieving or creating the default encryption key at the account level from vault',
                        { implName, error: err });
                    return cb(err);
                }

                const { encryptionKeyId, action } = data;
                log.trace('default encryption key retrieved or created at the account level from vault',
                    { implName, encryptionKeyId, action });
                return cb(null, {
                    // vault only return arn
                    masterKeyId: encryptionKeyId,
                    masterKeyArn: encryptionKeyId,
                    isAccountEncryptionEnabled: true,
                });
            });
        }
        // Otherwise, create a default master encryption key, later its id will be stored at the bucket metadata level.
        return client.createBucketKey(bucket.getName(), log, (err, masterKeyId, masterKeyArn) => {
            if (err) {
                log.debug('error from kms', { implName, error: err });
                return cb(err);
            }
            log.trace('bucket key created in kms');
            return cb(null, { masterKeyId, masterKeyArn });
        });
    }

     /**
      *