@@ -101,9 +101,8 @@ public void authenticatedEncryption_CustomerManagedKey() throws NoSuchAlgorithmE
101101 * MAC. Instead we use AES/CTR, an unauthenticated encryption algorithm. If {@link CryptoMode#StrictAuthenticatedEncryption}
102102 * is enabled, ranged GETs will not be allowed since they do not use authenticated encryption..
103103 */
104- // snippet-start:[s3.java1.s3_encrypt.strict_authenticated_encryption]
104+
105105 public void authenticatedEncryption_RangeGet_CustomerManagedKey () throws NoSuchAlgorithmException {
106- // snippet-start:[s3.java1.s3_encrypt.strict_authenticated_encryption_build]
107106 SecretKey secretKey = KeyGenerator .getInstance ("AES" ).generateKey ();
108107 AmazonS3Encryption s3Encryption = AmazonS3EncryptionClientBuilder
109108 .standard ()
@@ -113,14 +112,13 @@ public void authenticatedEncryption_RangeGet_CustomerManagedKey() throws NoSuchA
113112 .build ();
114113
115114 AmazonS3 s3NonEncrypt = AmazonS3ClientBuilder .defaultClient ();
116- // snippet-end:[s3.java1.s3_encrypt.strict_authenticated_encryption_build]
117115
118116 s3Encryption .putObject (BUCKET_NAME , ENCRYPTED_KEY , "some contents" );
119117 s3NonEncrypt .putObject (BUCKET_NAME , NON_ENCRYPTED_KEY , "some other contents" );
120118 System .out .println (s3Encryption .getObjectAsString (BUCKET_NAME , ENCRYPTED_KEY ));
121119 System .out .println (s3Encryption .getObjectAsString (BUCKET_NAME , NON_ENCRYPTED_KEY ));
122120 }
123- // snippet-end:[s3.java1.s3_encrypt.strict_authenticated_encryption]
121+
124122
125123 /**
126124 * Same as {@link #authenticatedEncryption_CustomerManagedKey()} except uses an asymmetric key pair and
@@ -148,7 +146,9 @@ public void authenticatedEncryption_CustomerManagedAsymmetricKey() throws NoSuch
148146 * {@link #authenticatedEncryption_CustomerManagedKey()} is that attempting to retrieve an object non
149147 * encrypted with AES/GCM will thrown an exception instead of falling back to encryption only or plaintext GET.
150148 */
149+ // snippet-start:[s3.java1.s3_encrypt.strict_authenticated_encryption]
151150 public void strictAuthenticatedEncryption_CustomerManagedKey () throws NoSuchAlgorithmException {
151+ // snippet-start:[s3.java1.s3_encrypt.strict_authenticated_encryption_build]
152152 SecretKey secretKey = KeyGenerator .getInstance ("AES" ).generateKey ();
153153 AmazonS3Encryption s3Encryption = AmazonS3EncryptionClientBuilder
154154 .standard ()
@@ -158,6 +158,7 @@ public void strictAuthenticatedEncryption_CustomerManagedKey() throws NoSuchAlgo
158158 .build ();
159159
160160 AmazonS3 s3NonEncrypt = AmazonS3ClientBuilder .defaultClient ();
161+ // snippet-end:[s3.java1.s3_encrypt.strict_authenticated_encryption_build]
161162
162163 s3Encryption .putObject (BUCKET_NAME , ENCRYPTED_KEY , "some contents" );
163164 s3NonEncrypt .putObject (BUCKET_NAME , NON_ENCRYPTED_KEY , "some other contents" );
@@ -169,6 +170,7 @@ public void strictAuthenticatedEncryption_CustomerManagedKey() throws NoSuchAlgo
169170 System .err .println (NON_ENCRYPTED_KEY + " was not encrypted with AES/GCM" );
170171 }
171172 }
173+ // snippet-end:[s3.java1.s3_encrypt.strict_authenticated_encryption]
172174
173175 /**
174176 * Strict authenticated encryption mode does not support ranged GETs. This is because we must use AES/CTR for ranged
@@ -292,7 +294,9 @@ public void encryptionOnly_KmsManagedKey() throws NoSuchAlgorithmException {
292294 /**
293295 * This uses the V2 metadata schema with a key wrap algorithm of 'kms' and a CEK algorithm of AES/GCM/NoPadding.
294296 */
297+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption]
295298 public void authenticatedEncryption_KmsManagedKey () throws NoSuchAlgorithmException {
299+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_builder]
296300 AmazonS3Encryption s3Encryption = AmazonS3EncryptionClientBuilder
297301 .standard ()
298302 .withRegion (Regions .US_WEST_2 )
@@ -302,20 +306,24 @@ public void authenticatedEncryption_KmsManagedKey() throws NoSuchAlgorithmExcept
302306 .build ();
303307
304308 AmazonS3 s3NonEncrypt = AmazonS3ClientBuilder .defaultClient ();
309+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_builder]
305310
311+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_put_object]
306312 s3Encryption .putObject (BUCKET_NAME , ENCRYPTED_KEY , "some contents" );
307313 s3NonEncrypt .putObject (BUCKET_NAME , NON_ENCRYPTED_KEY , "some other contents" );
308314 System .out .println (s3Encryption .getObjectAsString (BUCKET_NAME , ENCRYPTED_KEY ));
309315 System .out .println (s3Encryption .getObjectAsString (BUCKET_NAME , NON_ENCRYPTED_KEY ));
316+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_put_object]
310317 }
318+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption]
311319
312320 /**
313321 * Same as authenticatedEncryption_KmsManagedKey except throws an exception when trying to get objects not encrypted with
314322 * AES/GCM.
315323 */
316- // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption ]
324+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict ]
317325 public void strictAuthenticatedEncryption_KmsManagedKey () throws NoSuchAlgorithmException {
318- // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_builder ]
326+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_builder ]
319327 AmazonS3Encryption s3Encryption = AmazonS3EncryptionClientBuilder
320328 .standard ()
321329 .withRegion (Regions .US_WEST_2 )
@@ -325,23 +333,23 @@ public void strictAuthenticatedEncryption_KmsManagedKey() throws NoSuchAlgorithm
325333 .build ();
326334
327335 AmazonS3 s3NonEncrypt = AmazonS3ClientBuilder .defaultClient ();
328- // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_builder ]
336+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_builder ]
329337
330- // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_put_object ]
338+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_put_object ]
331339 s3Encryption .putObject (BUCKET_NAME , ENCRYPTED_KEY , "some contents" );
332340 s3NonEncrypt .putObject (BUCKET_NAME , NON_ENCRYPTED_KEY , "some other contents" );
333- // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_put_object ]
334- // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_exception ]
341+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_put_object ]
342+ // snippet-start:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_exception ]
335343 try {
336344 s3Encryption .getObjectAsString (BUCKET_NAME , NON_ENCRYPTED_KEY );
337345 } catch (SecurityException e ) {
338346 // Strict authenticated encryption will throw an exception if an object is not encrypted with AES/GCM
339347 System .err .println (NON_ENCRYPTED_KEY + " was not encrypted with AES/GCM" );
340348 }
341349
342- // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_exception ]
350+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict_exception ]
343351 }
344- // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption ]
352+ // snippet-end:[s3.java1.s3_encrypt.kms_authenticated_encryption_strict ]
345353
346354}
347355// snippet-end:[s3.java1.s3_encrypt.complete]
0 commit comments