Class swarmauri_keyprovider_aws_kms.AwsKmsKeyProvider.AwsKmsKeyProvider

swarmauri_keyprovider_aws_kms.AwsKmsKeyProvider.AwsKmsKeyProvider

AwsKmsKeyProvider(
    *, region, alias_prefix="swarmauri", key_policy=None
)

Bases: KeyProviderBase

AWS KMS-backed KeyProvider.

• Creates new KMS CMKs per (kid, version); maintains stable alias: alias// -> latest version alias///v -> specific version
• Rotation = create new KMS key (same alg/usage), bump /vN alias, repoint "latest".
• get_key(include_secret=...) never returns private material (KMS non-exportable).
• get_public_jwk() parses GetPublicKey DER to RFC 7517 JWK.
• jwks() publishes latest per 'kid' (resolved via stable alias) with kid.version.

IAM needed (minimum): kms:CreateKey, kms:CreateAlias, kms:UpdateAlias, kms:ListAliases, kms:DescribeKey, kms:ListResourceTags, kms:GetPublicKey, kms:ScheduleKeyDeletion

region: AWS region name (e.g., "us-east-1") alias_prefix: alias namespace (no 'alias/' prefix here). Final aliases look like: 'alias//' and 'alias///v' key_policy: optional explicit key policy JSON; if None, KMS uses account default.

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

def __init__(
    self,
    *,
    region: str,
    alias_prefix: str = "swarmauri",
    key_policy: Optional[dict] = None,
):
    """
    region: AWS region name (e.g., "us-east-1")
    alias_prefix: alias namespace (no 'alias/' prefix here). Final aliases look like:
                  'alias/<alias_prefix>/<kid>' and 'alias/<alias_prefix>/<kid>/v<ver>'
    key_policy: optional explicit key policy JSON; if None, KMS uses account default.
    """
    super().__init__()
    self._region = region
    self._alias_prefix = alias_prefix.strip("/")

    self._kms = boto3.client("kms", region_name=region)
    self._key_policy = key_policy

type class-attribute instance-attribute

type = 'AwsKmsKeyProvider'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

def supports(self) -> Mapping[str, Iterable[str]]:
    return {
        "class": ("sym", "asym"),
        "algs": (
            KeyAlg.AES256_GCM,
            KeyAlg.RSA_OAEP_SHA256,
            KeyAlg.RSA_PSS_SHA256,
            KeyAlg.ECDSA_P256_SHA256,
        ),
        "features": ("create", "rotate", "jwks", "non_exportable"),
    }

create_key async

create_key(spec)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def create_key(self, spec: KeySpec) -> KeyRef:
    kid = self._gen_kid()
    version = 1
    kms_spec = self._kms_spec_for_alg(spec)

    kwargs = {
        "KeyUsage": kms_spec.KeyUsage,
        "KeySpec": kms_spec.KeySpec,
        "Tags": [
            {"TagKey": "saur:kid", "TagValue": kid},
            {"TagKey": "saur:version", "TagValue": str(version)},
            {"TagKey": "saur:alg", "TagValue": spec.alg.value},
        ],
    }
    if spec.label:
        kwargs["Tags"].append({"TagKey": "saur:label", "TagValue": spec.label})
    if self._key_policy:
        kwargs["Policy"] = self._key_policy

    resp = self._kms.create_key(**kwargs)
    key_id = resp["KeyMetadata"]["KeyId"]

    self._create_or_update_alias(self._alias_version(kid, version), key_id)
    self._create_or_update_alias(self._alias_latest(kid), key_id)

    tags = {t["TagKey"]: t["TagValue"] for t in kwargs["Tags"]}
    return self._keyref_from_key_id(kid, version, key_id, tags=tags)

import_key async

import_key(spec, material, *, public=None)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def import_key(
    self, spec: KeySpec, material: bytes, *, public: Optional[bytes] = None
) -> KeyRef:
    raise NotImplementedError(
        "AWS KMS does not support importing private keys via this provider; use create_key()."
    )

rotate_key async

rotate_key(kid, *, spec_overrides=None)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def rotate_key(
    self, kid: str, *, spec_overrides: Optional[dict] = None
) -> KeyRef:
    latest_alias = self._alias_latest(kid)
    try:
        alias_desc = self._find_alias(latest_alias)
    except KeyError:
        raise KeyError(f"Unknown kid: {kid}")

    current_key_id = alias_desc["TargetKeyId"]
    current_tags = self._get_tags(current_key_id)
    current_alg = current_tags.get("saur:alg")
    if not current_alg:
        raise RuntimeError("Missing 'saur:alg' tag on current KMS key")

    alg = KeyAlg(current_alg)
    size_bits = (spec_overrides or {}).get("size_bits")
    label = (spec_overrides or {}).get("label", current_tags.get("saur:label"))
    uses = ()
    new_spec = KeySpec(
        klass=(
            KeyClass.symmetric if alg == KeyAlg.AES256_GCM else KeyClass.asymmetric
        ),
        alg=alg,
        size_bits=size_bits,
        label=label,
        export_policy=ExportPolicy.never_export_secret,
        uses=uses,
        tags=None,
    )

    try:
        versions = await self.list_versions(kid)
        next_version = (max(versions) + 1) if versions else 2
    except Exception:
        v = int(current_tags.get("saur:version", "1"))
        next_version = v + 1

    kms_spec = self._kms_spec_for_alg(new_spec)
    kwargs = {
        "KeyUsage": kms_spec.KeyUsage,
        "KeySpec": kms_spec.KeySpec,
        "Tags": [
            {"TagKey": "saur:kid", "TagValue": kid},
            {"TagKey": "saur:version", "TagValue": str(next_version)},
            {"TagKey": "saur:alg", "TagValue": alg.value},
        ],
    }
    if label:
        kwargs["Tags"].append({"TagKey": "saur:label", "TagValue": label})
    if self._key_policy:
        kwargs["Policy"] = self._key_policy

    resp = self._kms.create_key(**kwargs)
    new_key_id = resp["KeyMetadata"]["KeyId"]

    self._create_or_update_alias(self._alias_version(kid, next_version), new_key_id)
    self._create_or_update_alias(self._alias_latest(kid), new_key_id)

    return self._keyref_from_key_id(
        kid,
        next_version,
        new_key_id,
        tags={t["TagKey"]: t["TagValue"] for t in kwargs["Tags"]},
    )

destroy_key async

destroy_key(kid, version=None)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def destroy_key(self, kid: str, version: Optional[int] = None) -> bool:
    try:
        if version is None:
            for ver in await self.list_versions(kid):
                alias_name = self._alias_version(kid, ver)
                alias_desc = self._find_alias(alias_name)
                self._kms.schedule_key_deletion(
                    KeyId=alias_desc["TargetKeyId"], PendingWindowInDays=7
                )
            return True
        else:
            alias_name = self._alias_version(kid, version)
            alias_desc = self._find_alias(alias_name)
            self._kms.schedule_key_deletion(
                KeyId=alias_desc["TargetKeyId"], PendingWindowInDays=7
            )
            return True
    except Exception:
        return False

get_key async

get_key(kid, version=None, *, include_secret=False)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def get_key(
    self, kid: str, version: Optional[int] = None, *, include_secret: bool = False
) -> KeyRef:
    alias_name = (
        self._alias_version(kid, version) if version else self._alias_latest(kid)
    )
    alias_desc = self._find_alias(alias_name)
    key_id = alias_desc["TargetKeyId"]

    tags = self._get_tags(key_id)
    ver = int(tags.get("saur:version") or (version or 1))
    return self._keyref_from_key_id(kid, ver, key_id, tags=tags)

list_versions async

list_versions(kid)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def list_versions(self, kid: str) -> Tuple[int, ...]:
    prefix = f"alias/{self._alias_prefix}/{kid}/v"
    out: list[int] = []
    paginator = self._kms.get_paginator("list_aliases")
    for page in paginator.paginate():
        for a in page.get("Aliases", []):
            name = a.get("AliasName")
            if not name or not name.startswith(prefix):
                continue
            tail = name[len(prefix) :]
            if tail.isdigit():
                out.append(int(tail))
    if not out:
        try:
            self._find_alias(self._alias_latest(kid))
            out = [1]
        except KeyError:
            pass
    out.sort()
    return tuple(out)

get_public_jwk async

get_public_jwk(kid, version=None)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def get_public_jwk(self, kid: str, version: Optional[int] = None) -> dict:
    alias_name = (
        self._alias_version(kid, version) if version else self._alias_latest(kid)
    )
    alias_desc = self._find_alias(alias_name)
    key_id = alias_desc["TargetKeyId"]

    tags = self._get_tags(key_id)
    ver = int(tags.get("saur:version") or (version or 1))
    jwk_kid = f"{kid}.{ver}"

    try:
        pk = self._kms.get_public_key(KeyId=key_id).get("PublicKey")
        if not pk:
            return {"kty": "oct", "alg": "A256GCM", "kid": jwk_kid}
        return self._public_jwk_from_der(pk, jwk_kid)
    except ClientError as e:
        code = e.response.get("Error", {}).get("Code")
        if code in ("UnsupportedOperationException", "IncorrectKeySpecException"):
            return {"kty": "oct", "alg": "A256GCM", "kid": jwk_kid}
        raise

jwks async

jwks(*, prefix_kids=None)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def jwks(self, *, prefix_kids: Optional[str] = None) -> dict:
    keys = []
    base_prefix = f"alias/{self._alias_prefix}/"
    paginator = self._kms.get_paginator("list_aliases")
    seen_latest: set[str] = set()
    for page in paginator.paginate():
        for a in page.get("Aliases", []):
            name = a.get("AliasName") or ""
            if not name.startswith(base_prefix):
                continue
            tail = name[len(base_prefix) :]
            if "/v" in tail:
                continue
            kid = tail
            if prefix_kids and not kid.startswith(prefix_kids):
                continue
            if kid in seen_latest:
                continue
            seen_latest.add(kid)
            try:
                key_id = a["TargetKeyId"]
                tags = self._get_tags(key_id)
                ver = int(tags.get("saur:version", "1"))
                jwk = await self.get_public_jwk(kid, ver)
                keys.append(jwk)
            except Exception:
                continue
    return {"keys": keys}

random_bytes async

random_bytes(n)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def random_bytes(self, n: int) -> bytes:
    return os.urandom(n)

hkdf async

hkdf(ikm, *, salt, info, length)

Source code in swarmauri_keyprovider_aws_kms/AwsKmsKeyProvider.py

async def hkdf(self, ikm: bytes, *, salt: bytes, info: bytes, length: int) -> bytes:
    from cryptography.hazmat.primitives.kdf.hkdf import HKDF
    from cryptography.hazmat.primitives import hashes

    return HKDF(
        algorithm=hashes.SHA256(), length=length, salt=salt, info=info
    ).derive(ikm)

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger

get_key_by_ref async

get_key_by_ref(key_ref, *, include_secret=False)

Resolve simple URI-style key references into :class:KeyRef objects.

Subclasses must implement provider-specific resolution logic.

Source code in swarmauri_base/keys/KeyProviderBase.py

async def get_key_by_ref(
    self,
    key_ref: str,
    *,
    include_secret: bool = False,
) -> KeyRef:
    """Resolve simple URI-style key references into :class:`KeyRef` objects.

    Subclasses must implement provider-specific resolution logic.
    """

    raise NotImplementedError("get_key_by_ref must be implemented by subclasses")