Class AWSKMSKeySource

Creates a new key source instance.

Note: The config may be empty/undefined when using ClassFactory. Configuration is typically loaded from the database and passed when retrieving keys.

Human-readable name for this key source.

Cleans up the AWS KMS client.

Retrieves encryption key material from AWS KMS.

This method expects the lookupValue to contain a base64-encoded encrypted data key (ciphertext blob) that was encrypted using a KMS customer master key (CMK).

For envelope encryption pattern:

1. Generate a data key using KMS GenerateDataKey
2. Store the encrypted data key (CiphertextBlob) as base64 in lookupValue
3. This method decrypts it to get the plaintext key

Initializes the AWS KMS client.

Lazy-loads the AWS SDK to avoid requiring it when not used. Uses the default credential chain for authentication.

Checks if a key exists in AWS KMS.

Note: This only checks if the key ARN/alias format is valid. Actual key existence is verified on GetKey().

Validates that the AWS KMS client is properly configured.

Validates that the AWS KMS key is accessible by attempting a decrypt operation.

For envelope encryption, this decrypts the data key blob and validates its length. Key material is decoded internally for validation only — never returned to the caller.