Repository navigation
Make KMS key generation configurable for AwsKeyManagementClient and AliyunKeyManagementClient (currently always wraps) #18300
Description
Feature Request / Improvement
Current behavior
AwsKeyManagementClient always uses wrapKey to create key encryption keys and never calls generateKey, even though AWS KMS supports server-side generation (GenerateDataKey) and the client implements it. The same behavior on Aliyun.
Proposal
Make it configurable on both Aliyun and AWS.
Query engine
None
Willingness to contribute
- I can contribute this improvement/feature independently
- I would be willing to contribute this improvement/feature with guidance from the Iceberg community
- I cannot contribute this improvement/feature at this time
Activity
[-]Make KMS key generation configurable for AwsKeyManagementClient (currently always wraps)[/-][+]Make KMS key generation configurable for AwsKeyManagementClient and AliyunKeyManagementClient (currently always wraps)[/+]abhishekmauryaKsolves commentedon Sep 30, 2026
Hi, I'd like to work on the AWS part of this. My plan: add a config property (e.g. kms.client.aws.key-generation-enabled) read in AwsKeyManagementClient.initialize() and use it in supportsKeyGeneration(). Two questions: (1) what should the property name and default be? #18210 uses kms.client.aliyun.key.generation.enabled with default true, but keeping false would preserve current AWS behavior. (2) Should Aliyun be handled in #18210 or as a follow-up after it merges?
mengna-lin commentedon Sep 30, 2026
Hi,
Thanks for taking the AWS part.
encryption.kek-generation-enabledis ok? It is in same format ofencryption.key-id.abhishekmauryaKsolves commentedon Oct 1, 2026
Thanks!
encryption.kek-generation-enabledwith defaultfalsesounds good to me.I'll open a PR for the AWS part only, and leave Aliyun to you after #18210 merges.
abhishekmauryaKsolves commentedon Oct 1, 2026
Thanks! Looking at the code, AwsKeyManagementClient.supportsKeyGeneration() already returns true, and the KEK is always created via wrapKey in StandardEncryptionManager. So my plan is to add encryption.kek-generation-enabled (default false) to TableProperties and use it in StandardEncryptionManager: when enabled and the client supportsKeyGeneration(), call generateKey() instead of wrapKey(). This would apply to any KeyManagementClient, not only AWS. Does that match what you had in mind?
abhishekmauryaKsolves commentedon Oct 1, 2026
Opened #18337 for this. Note it adds the table property in core, so the generation path is available to any KeyManagementClient, not just AWS.