Skip to content

GH-51351: [C++][Parquet] Use default KMS connection values #53949

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Dricmoy wants to merge 2 commits into from
+19 −15
Closed

GH-51351: [C++][Parquet] Use default KMS connection values #53949

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0feea24
GH-51351: [C++][Parquet] Use default KMS connection values
Dricmoy Oct 16, 2026
537e296
GH-51351: [Python][Parquet] Update encryption tests for default KMS c…
Dricmoy Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cpp/src/parquet/encryption/file_key_wrapper.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ FileKeyWrapper::FileKeyWrapper(KeyToolkit* key_toolkit,
key_toolkit->kms_client_cache_per_token().CheckCacheForExpiredTokens(
cache_entry_lifetime_seconds_);
kms_client_ =
key_toolkit->GetKmsClient(kms_connection_config, cache_entry_lifetime_seconds_);
key_toolkit->GetKmsClient(kms_connection_config_, cache_entry_lifetime_seconds_);

if (double_wrapping) {
key_toolkit->kek_write_cache_per_token().CheckCacheForExpiredTokens(
Expand Down
12 changes: 6 additions & 6 deletions cpp/src/parquet/encryption/key_management_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -566,9 +566,9 @@ TEST_F(TestEncryptionKeyManagement, ReadKmsUrlFromFileDuringKeyRotation) {

ASSERT_EQ(requests.size(), 2);
// The first KMS creation request is for wrapping new keys.
// This uses the empty config provided.
EXPECT_EQ(requests[0].kms_instance_id, "");
EXPECT_EQ(requests[0].kms_instance_url, "");
// Empty values in the provided config are replaced with defaults.
EXPECT_EQ(requests[0].kms_instance_id, KmsClient::kKmsInstanceIdDefault);
EXPECT_EQ(requests[0].kms_instance_url, KmsClient::kKmsInstanceUrlDefault);
// The KMS client used to unwrap the previous keys should be configured
// with the instance ID and url provided at write time.
EXPECT_EQ(requests[1].kms_instance_id, "123");
Expand All @@ -582,9 +582,9 @@ TEST_F(TestEncryptionKeyManagement, KeyRotationWithoutReadingKmsUrl) {

ASSERT_EQ(requests.size(), 2);
// The first KMS creation request is for wrapping new keys.
// This uses the empty config provided.
EXPECT_EQ(requests[0].kms_instance_id, "");
EXPECT_EQ(requests[0].kms_instance_url, "");
// Empty values in the provided config are replaced with defaults.
EXPECT_EQ(requests[0].kms_instance_id, KmsClient::kKmsInstanceIdDefault);
EXPECT_EQ(requests[0].kms_instance_url, KmsClient::kKmsInstanceUrlDefault);
// When unwrapping the existing keys, the URL in the key material is
// ignored and the default used.
EXPECT_EQ(requests[1].kms_instance_id, "123");
Expand Down
10 changes: 6 additions & 4 deletions python/pyarrow/tests/parquet/test_encryption.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -763,12 +763,14 @@ def test_key_rotation_reads_kms_url_from_file(reusable_tempdir, data_table,
rotation_config, path, read_kms_url=read_kms_url)

if read_kms_url:
# The empty config provided is used to wrap new keys,
# and the config from the file was used to unwrap the original keys.
assert created_configs == [("", ""), (KMS_INSTANCE_ID, KMS_INSTANCE_URL)]
# Defaults are used to wrap new keys, and the config from the file
# is used to unwrap the original keys.
assert created_configs == [
("DEFAULT", "DEFAULT"), (KMS_INSTANCE_ID, KMS_INSTANCE_URL)]
else:
# The default URL is used when unwrapping the original keys.
assert created_configs == [("", ""), (KMS_INSTANCE_ID, "DEFAULT")]
assert created_configs == [
("DEFAULT", "DEFAULT"), (KMS_INSTANCE_ID, "DEFAULT")]

# New key material always uses the provided KMS connection configuration
rotated_keys = read_external_keys_to_dict(path)
Expand Down
10 changes: 6 additions & 4 deletions python/pyarrow/tests/test_dataset_encryption.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,12 +133,14 @@ def assert_decrypts(
encrypt_kms_connection_config = create_kms_connection_config(write_keys)
decrypt_kms_connection_config = create_kms_connection_config(read_keys)

crypto_factory = pe.CryptoFactory(kms_factory)
encrypt_crypto_factory = pe.CryptoFactory(kms_factory)
# Keep the writer's cached keys out of the reader's configuration.
decrypt_crypto_factory = pe.CryptoFactory(kms_factory)
parquet_encryption_cfg = ds.ParquetEncryptionConfig(
crypto_factory, encrypt_kms_connection_config, encryption_config
encrypt_crypto_factory, encrypt_kms_connection_config, encryption_config
)
parquet_decryption_cfg = ds.ParquetDecryptionConfig(
crypto_factory, decrypt_kms_connection_config, decryption_config
decrypt_crypto_factory, decrypt_kms_connection_config, decryption_config
)

# create write_options with dataset encryption config
Expand Down Expand Up @@ -176,7 +178,7 @@ def assert_decrypts(
assert table.select(read_columns).equals(dataset.to_table(read_columns))

# set decryption properties for parquet fragment scan options
decryption_properties = crypto_factory.file_decryption_properties(
decryption_properties = decrypt_crypto_factory.file_decryption_properties(
decrypt_kms_connection_config, decryption_config)
pq_scan_opts = ds.ParquetFragmentScanOptions(
decryption_properties=decryption_properties
Expand Down
Loading