[Question] Migrating from 2.4.1 to 3.0.0

[mode-ankit-khandelwal]

Problem:

Hello ESDK team 🙏

1. How do we migrate from CachingCryptoMaterialsManager to ICryptographicMaterialsManager and ICryptographicMaterialsCache?
2. How to restrict KeyRings to single keys similar to KmsMasterKeyProvider.builder().buildStrict(keyARN)?

Our existing code usage looks similar to below

OurCrypto(String keyID, String region, int cacheCapacity, int cacheMaxAgeMinutes, String accountId, RegionalClientSupplier factory) {
  this.encryptionKeyProvider = KmsMasterKeyProvider
      .builder()
      .customRegionalClientSupplier(factory)
      .defaultRegion(Region.of(region))
      .buildStrict(keyID);
  
  var decryptionKeyProvider = KmsMasterKeyProvider
      .builder()
      .customRegionalClientSupplier(factory)
      .defaultRegion(Region.of(region))
      .buildDiscovery(new DiscoveryFilter(PARTITION, List.of(accountId)));
  
  this.manager = CachingCryptoMaterialsManager.newBuilder()
      .withMasterKeyProvider(decryptionKeyProvider)
      .withCache(new LocalCryptoMaterialsCache(cacheCapacity))
      .withMaxAge(cacheMaxAgeMinutes, TimeUnit.MINUTES)
      .build();
}

[lucasmcdonald3]

Hi @mode-ankit-khandelwal,

1. You cannot use Keyrings with the CachingCMM; the ICryptographicMaterialsManager and ICryptographicMaterialsCache will not work with the legacy CachingCMM. We (AWS Crypto Tools) must release a new caching CMM in the AWS Cryptographic Material Providers Library (MPL) before you can migrate.
2. If you are only using a single key ARN, check out the AwsKmsKeyring: link. This keyring takes in a single KMS key ARN.
   If you need to use multiple key ARNs, check out the AwsKmsMultiKeyring: link. This keyring takes in a generator key and a list of key ARNs. (See this code example configuring and using this keyring.)

Thanks,
Lucas

[pedrofurlanetto90]

Hello all, @lucasmcdonald3 have your team released a new caching CCM? I'm migrating to AWS Encryption SDK V3 and I need this feature to move on

[GonzaloPardoVillalibre]

Hello @lucasmcdonald3, are there any updates here? 😇

We're currently preparing to migrate to AWS Encryption SDK V3, primarily to leverage support for RSA public key encryption via RawRsaKeyring — a feature not available in V2, where MasterKeyProvider requires private key access as well.

However, we're hitting a challenge around caching. In V2, caching is enabled through CachingCryptoMaterialsManager, which requires a CryptoMaterialsManager as the backing implementation. Unfortunately, DefaultCryptoMaterialsManager only supports MasterKeyProvider, not IKeyring, which is the interface for RawRsaKeyring. Meanwhile, in V3, as far as I know, caching is only supported for AwsKmsHierarchicalKeyring.

This creates a gap — there's currently no native way to enable caching for keyring-based encryption, even though RawRsaKeyring is ideal for public-only scenarios like event producers.

Question: Are there any plans to introduce first-class support for caching with keyrings — either by extending ICryptographicMaterialsCache support beyond AwsKmsHierarchicalKeyring, or through another mechanism?

In the short term, we're okay proceeding without caching, but knowing whether this is on the roadmap would help us assess the long-term impact or explore alternative approaches.

Thanks again for all the great work on this SDK! 🙌