Aws Kms Compliance Checker

KMS Compliance Checker

A Java compiler plugin that proves, at compile-time, that Java code only requests 256-bit data keys from [AWS KMS](https://aws.amazon.com/kms/).

What's it for?

A common compliance requirement (e.g. for SOC or PCI-DSS) is that data encrypted at rest must be encrypted with 256-bit keys. If you're using AWS KMS to generate data keys that encrypt your data, this checker can enforce that every data key you request from KMS is 256-bit. In a traditional manual audit, an auditor may not be able to examine every line of your code. By contrast, running this checker is automatic and comprehensive: the checker scans an entire codebase in seconds and reports any violations. If the check passes, you can be confident that you never request keys shorter than 256 bits from AWS KMS.

Usage

The Maven coordinates for the latest version are

```software.amazon.checkerframework:aws-kms-compliance-checker:1.0.2```

The (https://github.com/awslabs/aws-kms-compliance-checker/tree/master/examples)[examples] directory has examples of how to use the checker with some popular Java build systems.

Gradle

To use Gradle add the Checker Framework and KMS key length checker to the dependencies as shown in (https://github.com/awslabs/aws-kms-compliance-checker/blob/master/examples/build.gradle)[build.gradle].

dependencies {
  ...
  annotationProcessor "software.amazon.checkerframework:aws-kms-compliance-checker:1.0.2"
  checkerFrameworkAnnotatedJDK "org.checkerframework:jdk8:3.3.0"
  implementation "org.checkerframework:checker-qual:3.3.0"
}

configurations {
  checkerFrameworkAnnotatedJDK
}

and add this checker to the list of processors

   options.compilerArgs = [
        '-processor', 'com.amazon.checkerframework.compliance.kms.ComplianceChecker, ...,
        '-Xbootclasspath/p:${configurations.checkerFrameworkAnnotatedJDK.asPath}'
   ]

Now when you run `gradle build` the build will fail if you are using 128-bit keys.

Maven

For an e