Making it possible for KMS GetPublicKey to get ENCRYPT_DECRYPT keys. (#6675)

taras-kobernyk-localstack · web-flow · commit 1ba1a8a74ee8 · 2022-08-18T17:19:11.000+02:00
diff --git a/localstack/services/kms/provider.py b/localstack/services/kms/provider.py
@@ -141,8 +141,9 @@ def create_key(
         result = call_moto(context)
 
         # generate keypair for signing, if this is a SIGN_VERIFY key
-        key_usage = create_key_request.get("KeyUsage")
-        if key_usage == "SIGN_VERIFY":
+        key_usage = create_key_request.get("KeyUsage", "ENCRYPT_DECRYPT")
+        key_spec = create_key_request.get("KeySpec", "SYMMETRIC_DEFAULT")
+        if not (key_usage == "ENCRYPT_DECRYPT" and key_spec == "SYMMETRIC_DEFAULT"):
             create_key_request["KeyId"] = result["KeyMetadata"]["KeyId"]
             _generate_data_key_pair(create_key_request, create_cipher=False)
 
@@ -268,6 +269,7 @@ def list_retirable_grants(
 
         return ListGrantsResponse(Grants=in_limit, Truncated=True, NextMarker=marker_id)
 
+    @handler("GetPublicKey")
     def get_public_key(
         self, context: RequestContext, key_id: KeyIdType, grant_tokens: GrantTokenList = None
     ) -> GetPublicKeyResponse:
@@ -567,7 +569,7 @@ def _generate_data_key_pair(data, create_cipher=True, add_to_keys=True):
         "KeyId": key_id,
         "KeyPairSpec": key_spec,
         "KeySpec": key_spec,
-        "KeyUsage": "SIGN_VERIFY",
+        "KeyUsage": data.get("KeyUsage", "ENCRYPT_DECRYPT"),
         "Policy": data.get("Policy"),
         "Region": region,
         "Description": data.get("Description"),
diff --git a/tests/integration/test_kms.py b/tests/integration/test_kms.py
@@ -153,6 +153,10 @@ def _verify(signature):
         with pytest.raises(InvalidSignature):
             _verify(result["Signature"] + b"foobar")
 
+    def test_get_public_key(self, kms_client, kms_create_key):
+        key_id = kms_create_key(KeyUsage="ENCRYPT_DECRYPT", KeySpec="RSA_2048")["KeyId"]
+        kms_client.get_public_key(KeyId=key_id)
+
     @pytest.mark.aws_validated
     def test_get_and_list_sign_key(self, kms_client, kms_create_key):
         response = kms_create_key(KeyUsage="SIGN_VERIFY", CustomerMasterKeySpec="ECC_NIST_P256")
