Support AWS KMS Encryption Context

[dictcp]

• user can specify "Encryption Context" to each data key encrypted by KMS
• the Encryption Context can be used to restrict access with KMS Policy

some reference on encryption context added:
http://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html
http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html

[jvehent]

I haven't used KMS encryption contexts, but would there be a way to expand this to not require JSON on the command line but take individual parameters instead? We already have a custom csv format for specifying multiple kms and pgp on the command line, and I'd prefer to avoid introducing another format.

[jvehent]

This is a interesting feature, thanks for sending the patch!

Could you add some documentation to the README to explain how this is meant to be used? I'd also suggest adding a couple unit tests.

[dictcp]

@jvehent thanks for the comment.

the code is refactored to use context string like "Key1:Value1,Key2:Value2" to better align with existing convention. also I have update the README.md and unit test.

regrading to encryption context, you may be interested in related doc from credstash and sneaker (both of them support encryption context as well)
https://github.com/fugue/credstash#controlling-and-auditing-secrets
https://github.com/codahale/sneaker#encryption-contexts

[jvehent]

to refine the access control of a given KMS master key.

[jvehent]

This is getting close, I just have a couple comments on the documentation. Once you fix them, I'll merge the patch and we can test it for a couple weeks before releasing 1.14.

[jvehent]

Thanks for the patches! The build is breaking before of unrelated issues, so I'm going to merge this and fix the rest in master.

This looks neat, much appreciated! + 💯 👍