private static SecuredCEK secureCEK(SecretKey cek,
EncryptionMaterials materials, S3KeyWrapScheme kwScheme,
SecureRandom srand, Provider p, AWSKMSClient kms,
AmazonWebServiceRequest req) {
if (materials.isKMSEnabled()) {
EncryptRequest encryptRequest = new EncryptRequest()
.withEncryptionContext(materials.getMaterialsDescription())
.withKeyId(materials.getCustomerMasterKeyId())
.withPlaintext(ByteBuffer.wrap(cek.getEncoded()))
;
encryptRequest
.withGeneralProgressListener(req.getGeneralProgressListener())
.withRequestMetricCollector(req.getRequestMetricCollector())
;
EncryptResult encryptResult = kms.encrypt(encryptRequest);
byte[] keyBlob = copyAllBytesFrom(encryptResult.getCiphertextBlob());