{"id":7020,"library":"aws-cryptographic-material-providers","title":"AWS Cryptographic Material Providers Library","description":"The AWS Cryptographic Material Providers Library for Python offers advanced key management functionalities, primarily focusing on KMS keyrings, for use with the AWS Encryption SDK. It simplifies the process of obtaining and managing cryptographic materials from sources like AWS KMS. The current version is 1.11.2, and it receives updates typically several times a year, often in conjunction with the AWS Encryption SDK or for KMS feature enhancements.","status":"active","version":"1.11.2","language":"python","source_language":"en","source_url":"https://github.com/aws/aws-sdk-encryption-python","tags":["aws","kms","encryption","cryptography","keyring","security"],"install":[{"cmd":"pip install aws-cryptographic-material-providers","lang":"bash","label":"Install latest version"}],"dependencies":[{"reason":"Required for interacting with AWS KMS and other AWS services.","package":"boto3","optional":false},{"reason":"Provides underlying cryptographic primitives and operations.","package":"cryptography","optional":false},{"reason":"While this library provides material providers, its primary utility is realized when integrated with the AWS Encryption SDK for actual encryption/decryption operations. It's often installed as a dependency of the SDK.","package":"aws-encryption-sdk","optional":true}],"imports":[{"wrong":"from aws_cryptographic_material_providers.mpl import KmsKeyring","symbol":"KmsKeyring","correct":"from aws_cryptographic_material_providers.mpl import KmsKeyring"}],"quickstart":{"code":"import os\nfrom aws_encryption_sdk import EncryptionSDKClient\nfrom aws_encryption_sdk.keyrings.kms import KmsKeyring\nimport boto3\n\n# Replace with your KMS Key ARN (e.g., arn:aws:kms:REGION:ACCOUNT:key/KEY_ID)\nKMS_KEY_ARN = os.environ.get(\"KMS_KEY_ARN\", \"arn:aws:kms:us-east-1:123456789012:key/EXAMPLE-KEY-ID\")\n\nif \"EXAMPLE-KEY-ID\" in KMS_KEY_ARN:\n    print(\"WARNING: Please set the KMS_KEY_ARN environment variable to a valid KMS key.\")\n    print(\"Example: export KMS_KEY_ARN=arn:aws:kms:us-east-1:123456789012:key/your-key-id\")\n\n# Initialize the AWS Encryption SDK client\nclient = EncryptionSDKClient()\n\n# Initialize the KMS Keyring\n# For production, consider passing an explicit boto3 KMS client for better control:\n# kms_client = boto3.client(\"kms\", region_name=os.environ.get(\"AWS_REGION\", \"us-east-1\"))\n# keyring = KmsKeyring(generator_key_id=KMS_KEY_ARN, client=kms_client)\nkeyring = KmsKeyring(generator_key_id=KMS_KEY_ARN)\n\n# Example data to encrypt\nplain_text = b\"my secret data\"\n\nif \"EXAMPLE-KEY-ID\" not in KMS_KEY_ARN:\n    # Encrypt the data\n    ciphertext, header = client.encrypt(source=plain_text, keyring=keyring)\n    print(f\"Encrypted data (first 50 bytes): {ciphertext[:50]}...\")\n\n    # Decrypt the data\n    decrypted_text, _ = client.decrypt(source=ciphertext, keyring=keyring)\n    print(f\"Decrypted data: {decrypted_text}\")\n\n    assert decrypted_text == plain_text\n    print(\"Encryption and decryption successful!\")\nelse:\n    print(\"\\nKMS Keyring initialized. To perform actual encryption/decryption, set KMS_KEY_ARN and ensure AWS credentials are configured.\")\n    print(\"This quickstart demonstrates the instantiation and use of KmsKeyring within the AWS Encryption SDK context.\")\n","lang":"python","description":"This quickstart demonstrates how to initialize `KmsKeyring` and use it with the `EncryptionSDKClient` from the `aws-encryption-sdk` to encrypt and decrypt data. A valid AWS KMS Key ARN and appropriate AWS credentials are required for successful execution. If `KMS_KEY_ARN` is not set, it will only demonstrate the keyring instantiation."},"warnings":[{"fix":"Upgrade your Python environment to 3.11 or later. Check the `requires_python` field in PyPI for the latest requirements.","message":"The library now requires Python 3.11 or newer. Older Python versions (e.g., 3.8, 3.9, 3.10) are no longer supported, leading to installation or runtime errors.","severity":"breaking","affected_versions":"<1.11.0"},{"fix":"Always install `aws-cryptographic-material-providers` in a clean virtual environment or ensure `pip install -U aws-cryptographic-material-providers` to let pip resolve compatible dependencies. Avoid manually pinning `boto3` or `cryptography` to versions outside the library's specified ranges (`~=1.34.0` for boto3, `~=42.0.5` for cryptography in 1.11.2).","message":"Strict dependency on specific `boto3` and `cryptography` versions. Installing incompatible versions of these libraries can lead to runtime errors or unexpected behavior due to API changes or missing features.","severity":"gotcha","affected_versions":"All versions"},{"fix":"When initializing `KmsKeyring`, provide an explicit `boto3.client('kms', region_name='...')` instance. For example: `kms_client = boto3.client('kms'); keyring = KmsKeyring(generator_key_id=KMS_KEY_ARN, client=kms_client)`.","message":"Relying on implicit `boto3` client creation for `KmsKeyring` can lead to issues in complex environments or when using specific region/config overrides. It's best practice to explicitly pass a configured `boto3` KMS client.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'1.11.2':50 'advanc':15 'aw':1,7,28,44,65,73 'conjunct':62 'cryptograph':2,8,39 'cryptographi':76 'current':47 'encrypt':29,66,75 'enhanc':72 'featur':71 'focus':20 'function':18 'key':16 'keyr':23,77 'kms':22,45,70,74 'librari':5,11 'like':43 'manag':17,38 'materi':3,9,40 'obtain':36 'offer':14 'often':60 'primarili':19 'process':34 'provid':4,10 'python':13 'receiv':53 'sdk':30,67 'secur':78 'sever':56 'simplifi':32 'sourc':42 'time':57 'typic':55 'updat':54 'use':25 'version':48 'year':59","created_at":"2026-04-16T13:40:00.077108+00:00","updated_at":"2026-04-16T13:40:00.077108+00:00","problems":{"verify_error":"Traceback (most recent call last):\n  File \"<string>\", line 1, in <module>\nImportError: cannot import name 'KmsKeyring' from 'aws_cryptographic_material_providers.mpl' (/tmp/tmpyrnvbfpy/venv/lib/python3.12/site-packages/aws_cryptographic_material_providers/mpl/__init__.py)"},"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"1.11.2","cli_name":"","cli_version":null,"type":"library","homepage":"https://aws.amazon.com/encryption-sdk/","github":null,"docs":null,"changelog":null,"pypi":"https://pypi.org/project/aws-cryptographic-material-providers/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["aws","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"import_fail","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-07-10","install_tag":null}}