localstack-core 4.10.1.dev7__py3-none-any.whl → 4.11.2.dev14__py3-none-any.whl

localstack/services/cloudformation/v2/provider.py

@@ -135,15 +135,15 @@ SSM_PARAMETER_TYPE_RE = re.compile(
 
 
 def is_stack_arn(stack_name_or_id: str) -> bool:
-    return ARN_STACK_REGEX.match(stack_name_or_id) is not None
+    return stack_name_or_id and ARN_STACK_REGEX.match(stack_name_or_id) is not None
 
 
 def is_changeset_arn(change_set_name_or_id: str) -> bool:
-    return ARN_CHANGESET_REGEX.match(change_set_name_or_id) is not None
+    return change_set_name_or_id and ARN_CHANGESET_REGEX.match(change_set_name_or_id) is not None
 
 
 def is_stack_set_arn(stack_set_name_or_id: str) -> bool:
-    return ARN_STACK_SET_REGEX.match(stack_set_name_or_id) is not None
+    return stack_set_name_or_id and ARN_STACK_SET_REGEX.match(stack_set_name_or_id) is not None
 
 
 class StackNotFoundError(ValidationError):
@@ -1349,8 +1349,8 @@ class CloudformationProviderV2(CloudformationProvider, ServiceLifecycleHook):
     def describe_stack_events(
         self,
         context: RequestContext,
-        stack_name: StackName = None,
-        next_token: NextToken = None,
+        stack_name: StackName,
+        next_token: NextToken | None = None,
         **kwargs,
     ) -> DescribeStackEventsOutput:
         if not stack_name:
@@ -1388,7 +1388,7 @@ class CloudformationProviderV2(CloudformationProvider, ServiceLifecycleHook):
                     stack_name, message_override=f"Stack with id {stack_name} does not exist"
                 )
         else:
-            raise StackNotFoundError(stack_name)
+            raise ValidationError("StackName is required if ChangeSetName is not specified.")
 
         if template_stage == TemplateStage.Processed and "Transform" in stack.template_body:
             template_body = json.dumps(stack.processed_template)

localstack/services/cloudwatch/provider.py

@@ -35,6 +35,7 @@ from localstack.services import moto
 from localstack.services.cloudwatch.alarm_scheduler import AlarmScheduler
 from localstack.services.edge import ROUTER
 from localstack.services.plugins import SERVICE_PLUGINS, ServiceLifecycleHook
+from localstack.state import StateVisitor
 from localstack.utils.aws import arns
 from localstack.utils.aws.arns import extract_account_id_from_arn, lambda_function_name
 from localstack.utils.aws.request_context import (
@@ -306,8 +307,13 @@ class CloudwatchProvider(CloudwatchApi, ServiceLifecycleHook):
         self.tags = TaggingService()
         self.alarm_scheduler = None
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        visitor.visit(cloudwatch_backends)
+
     def on_after_init(self):
         ROUTER.add(PATH_GET_RAW_METRICS, self.get_raw_metrics)
+
+    def on_before_start(self):
         self.start_alarm_scheduler()
 
     def on_before_state_reset(self):
@@ -337,9 +343,10 @@ class CloudwatchProvider(CloudwatchApi, ServiceLifecycleHook):
             self.alarm_scheduler = AlarmScheduler()
 
     def shutdown_alarm_scheduler(self):
-        LOG.debug("stopping cloudwatch scheduler")
-        self.alarm_scheduler.shutdown_scheduler()
-        self.alarm_scheduler = None
+        if self.alarm_scheduler:
+            LOG.debug("stopping cloudwatch scheduler")
+            self.alarm_scheduler.shutdown_scheduler()
+            self.alarm_scheduler = None
 
     def delete_alarms(self, context: RequestContext, alarm_names: AlarmNames, **kwargs) -> None:
         moto.call_moto(context)

localstack/services/cloudwatch/provider_v2.py

@@ -161,6 +161,8 @@ class CloudwatchProvider(CloudwatchApi, ServiceLifecycleHook):
 
     def on_after_init(self):
         ROUTER.add(PATH_GET_RAW_METRICS, self.get_raw_metrics)
+
+    def on_before_start(self):
         self.start_alarm_scheduler()
 
     def on_before_state_reset(self):
@@ -192,9 +194,10 @@ class CloudwatchProvider(CloudwatchApi, ServiceLifecycleHook):
             self.alarm_scheduler = AlarmScheduler()
 
     def shutdown_alarm_scheduler(self):
-        LOG.debug("stopping cloudwatch scheduler")
-        self.alarm_scheduler.shutdown_scheduler()
-        self.alarm_scheduler = None
+        if self.alarm_scheduler:
+            LOG.debug("stopping cloudwatch scheduler")
+            self.alarm_scheduler.shutdown_scheduler()
+            self.alarm_scheduler = None
 
     def delete_alarms(self, context: RequestContext, alarm_names: AlarmNames, **kwargs) -> None:
         """

localstack/services/configservice/provider.py

@@ -1,5 +1,9 @@
 from localstack.aws.api.config import ConfigApi
+from localstack.state import StateVisitor
 
 
 class ConfigProvider(ConfigApi):
-    pass
+    def accept_state_visitor(self, visitor: StateVisitor):
+        from moto.config.models import config_backends
+
+        visitor.visit(config_backends)

localstack/services/dynamodb/provider.py

@@ -535,6 +535,7 @@ class DynamoDBProvider(DynamodbApi, ServiceLifecycleHook):
         self.server = self._new_dynamodb_server()
         self._expired_items_worker = ExpiredItemsWorker()
         self._router_rules = []
+        # TODO: fix _event_forwarder to have lazy instantiation of the ThreadPoolExecutor
         self._event_forwarder = EventForwarder()
 
     def on_before_start(self):

localstack/services/dynamodb/v2/provider.py

@@ -392,6 +392,7 @@ class DynamoDBProvider(DynamodbApi, ServiceLifecycleHook):
 
     def accept_state_visitor(self, visitor: StateVisitor):
         visitor.visit(dynamodb_stores)
+        # FIXME: DDB v2 does not depend on dynamodbstreams_stores as DynamoDB Local holds all the state
         visitor.visit(dynamodbstreams_stores)
         visitor.visit(AssetDirectory(self.service, os.path.join(config.dirs.data, self.service)))
 

localstack/services/dynamodbstreams/provider.py

@@ -37,6 +37,7 @@ from localstack.services.dynamodbstreams.dynamodbstreams_api import (
     table_name_from_stream_arn,
 )
 from localstack.services.plugins import ServiceLifecycleHook
+from localstack.state import StateVisitor
 from localstack.utils.collections import select_from_typed_dict
 
 LOG = logging.getLogger(__name__)
@@ -57,6 +58,11 @@ class DynamoDBStreamsProvider(DynamodbstreamsApi, ServiceLifecycleHook):
     def __init__(self):
         self.shard_to_region = {}
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        from localstack.services.dynamodbstreams.models import dynamodbstreams_stores
+
+        visitor.visit(dynamodbstreams_stores)
+
     def describe_stream(
         self,
         context: RequestContext,

localstack/services/dynamodbstreams/v2/provider.py

@@ -18,6 +18,7 @@ from localstack.services.dynamodb.utils import modify_ddblocal_arns
 from localstack.services.dynamodb.v2.provider import DynamoDBProvider, modify_context_region
 from localstack.services.dynamodbstreams.dynamodbstreams_api import get_original_region
 from localstack.services.plugins import ServiceLifecycleHook
+from localstack.state import StateVisitor
 from localstack.utils.aws.arns import parse_arn
 
 LOG = logging.getLogger(__name__)
@@ -32,6 +33,11 @@ class DynamoDBStreamsProvider(DynamodbstreamsApi, ServiceLifecycleHook):
         self.server = DynamodbServer.get()
         self.shard_to_region = {}
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        # DynamoDB Streams state is entirely dependent on DynamoDB Local state, and does not hold state itself
+        # the DynamoDB provider is responsible for the persistence of DDB Streams
+        pass
+
     def on_after_init(self):
         # add response processor specific to ddblocal
         handlers.modify_service_response.append(self.service, modify_ddblocal_arns)

localstack/services/ec2/provider.py

@@ -94,6 +94,7 @@ from localstack.services.ec2.models import get_ec2_backend
 from localstack.services.ec2.patches import apply_patches
 from localstack.services.moto import call_moto, call_moto_with_request
 from localstack.services.plugins import ServiceLifecycleHook
+from localstack.state import StateVisitor
 from localstack.utils.patch import patch
 from localstack.utils.strings import first_char_to_upper, long_uid, short_uid
 
@@ -107,6 +108,11 @@ class Ec2Provider(Ec2Api, ABC, ServiceLifecycleHook):
     def on_after_init(self):
         apply_patches()
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        from moto.ec2.models import ec2_backends
+
+        visitor.visit(ec2_backends)
+
     @handler("DescribeAvailabilityZones", expand=False)
     def describe_availability_zones(
         self,

localstack/services/es/provider.py

@@ -68,6 +68,7 @@ from localstack.aws.api.opensearch import (
 )
 from localstack.aws.connect import connect_to
 from localstack.services.opensearch.packages import ELASTICSEARCH_DEFAULT_VERSION
+from localstack.state import StateVisitor
 
 
 def _version_to_opensearch(
@@ -208,6 +209,11 @@ def exception_mapper():
 
 
 class EsProvider(EsApi):
+    def accept_state_visitor(self, visitor: StateVisitor):
+        # ES state entirely depends on `opensearch`, and delegates its entire state to it
+        # we do not need to manage state in ES
+        pass
+
     def create_elasticsearch_domain(
         self,
         context: RequestContext,

localstack/services/events/provider.py

@@ -168,6 +168,7 @@ from localstack.services.events.utils import (
     recursive_remove_none_values_from_dict,
 )
 from localstack.services.plugins import ServiceLifecycleHook
+from localstack.state import StateVisitor
 from localstack.utils.common import truncate
 from localstack.utils.event_matcher import matches_event
 from localstack.utils.strings import long_uid
@@ -246,6 +247,9 @@ class EventsProvider(EventsApi, ServiceLifecycleHook):
         self._connection_service_store: ConnectionServiceDict = {}
         self._api_destination_service_store: ApiDestinationServiceDict = {}
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        visitor.visit(events_stores)
+
     def on_before_start(self):
         JobScheduler.start()
 

localstack/services/events/v1/provider.py

@@ -45,6 +45,7 @@ from localstack.services.events.scheduler import JobScheduler
 from localstack.services.events.v1.models import EventsStore, events_stores
 from localstack.services.moto import call_moto
 from localstack.services.plugins import ServiceLifecycleHook
+from localstack.state import StateVisitor
 from localstack.utils.aws.arns import event_bus_arn, parse_arn
 from localstack.utils.aws.client_types import ServicePrincipal
 from localstack.utils.aws.message_forwarding import send_event_to_target
@@ -83,6 +84,14 @@ class EventsProvider(EventsApi, ServiceLifecycleHook):
     def on_before_stop(self):
         JobScheduler.shutdown()
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        from moto.events.models import events_backends
+
+        from localstack.services.events.v1.models import events_stores
+
+        visitor.visit(events_backends)
+        visitor.visit(events_stores)
+
     @route("/_aws/events/rules/<path:rule_arn>/trigger")
     def trigger_scheduled_rule(self, request: Request, rule_arn: str):
         """Developer endpoint to trigger a scheduled rule."""

localstack/services/firehose/provider.py

@@ -94,6 +94,7 @@ from localstack.services.firehose.mappers import (
     convert_source_config_to_desc,
 )
 from localstack.services.firehose.models import FirehoseStore, firehose_stores
+from localstack.state import StateVisitor
 from localstack.utils.aws.arns import (
     extract_account_id_from_arn,
     extract_region_from_arn,
@@ -251,8 +252,12 @@ class FirehoseProvider(FirehoseApi):
 
     def __init__(self) -> None:
         super().__init__()
+        # TODO: stop/restart the kinesis listeners when stopping the service / reset the state / restore the state
         self.kinesis_listeners = {}
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        visitor.visit(firehose_stores)
+
     @staticmethod
     def get_store(account_id: str, region_name: str) -> FirehoseStore:
         return firehose_stores[account_id][region_name]

localstack/services/iam/provider.py

@@ -75,6 +75,7 @@ from localstack.services.iam.resources.policy_simulator import (
 )
 from localstack.services.iam.resources.service_linked_roles import SERVICE_LINKED_ROLES
 from localstack.services.moto import call_moto
+from localstack.state import StateVisitor
 from localstack.utils.aws.request_context import extract_access_key_id_from_auth_header
 
 LOG = logging.getLogger(__name__)
@@ -110,6 +111,9 @@ class IamProvider(IamApi):
         apply_iam_patches()
         self.policy_simulator = BasicIAMPolicySimulator()
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        visitor.visit(iam_backends)
+
     @handler("CreateRole", expand=False)
     def create_role(
         self, context: RequestContext, request: CreateRoleRequest

localstack/services/kinesis/packages.py

@@ -7,7 +7,7 @@ from localstack.packages import InstallTarget, Package
 from localstack.packages.core import GitHubReleaseInstaller, NodePackageInstaller
 from localstack.packages.java import JavaInstallerMixin, java_package
 
-_KINESIS_MOCK_VERSION = os.environ.get("KINESIS_MOCK_VERSION") or "0.4.13"
+_KINESIS_MOCK_VERSION = os.environ.get("KINESIS_MOCK_VERSION") or "0.5.1"
 
 
 class KinesisMockEngine(StrEnum):

localstack/services/kms/models.py

@@ -20,7 +20,6 @@ from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
 from cryptography.hazmat.primitives.asymmetric.padding import PSS, PKCS1v15
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.hazmat.primitives.asymmetric.utils import Prehashed
-from cryptography.hazmat.primitives.kdf.hkdf import HKDF
 from cryptography.hazmat.primitives.serialization import load_der_public_key
 
 from localstack.aws.api.kms import (
@@ -173,6 +172,7 @@ class KmsCryptoKey:
     public_key: bytes | None
     private_key: bytes | None
     key_material: bytes
+    pending_key_material: bytes | None
     key_spec: str
 
     @staticmethod
@@ -217,6 +217,7 @@ class KmsCryptoKey:
     def __init__(self, key_spec: str, key_material: bytes | None = None):
         self.private_key = None
         self.public_key = None
+        self.pending_key_material = None
         # Technically, key_material, being a symmetric encryption key, is only relevant for
         #   key_spec == SYMMETRIC_DEFAULT.
         # But LocalStack uses symmetric encryption with this key_material even for other specs. Asymmetric keys are
@@ -248,8 +249,9 @@ class KmsCryptoKey:
         self._serialize_key(key)
 
     def load_key_material(self, material: bytes):
-        if self.key_spec in [
-            KeySpec.SYMMETRIC_DEFAULT,
+        if self.key_spec == KeySpec.SYMMETRIC_DEFAULT:
+            self.pending_key_material = material
+        elif self.key_spec in [
             KeySpec.HMAC_224,
             KeySpec.HMAC_256,
             KeySpec.HMAC_384,
@@ -323,9 +325,28 @@ class KmsKey:
             # remove the _custom_key_material_ tag from the tags to not readily expose the custom key material
             del self.tags[TAG_KEY_CUSTOM_KEY_MATERIAL]
         self.crypto_key = KmsCryptoKey(self.metadata.get("KeySpec"), custom_key_material)
+        self._internal_key_id = uuid.uuid4()
+
+        # The KMS implementation always provides a crypto key with key material which doesn't suit scenarios where a
+        # KMS Key may have no key material e.g. for external keys. Don't expose the CurrentKeyMaterialId in those cases.
+        if custom_key_material or (
+            self.metadata["Origin"] == "AWS_KMS"
+            and self.metadata["KeySpec"] == KeySpec.SYMMETRIC_DEFAULT
+        ):
+            self.metadata["CurrentKeyMaterialId"] = self.generate_key_material_id(
+                self.crypto_key.key_material
+            )
+
         self.rotation_period_in_days = 365
         self.next_rotation_date = None
 
+    def generate_key_material_id(self, key_material: bytes) -> str:
+        # The KeyMaterialId depends on the key material and the KeyId. Use an internal ID to prevent brute forcing
+        # the value of the key material from the public KeyId and KeyMaterialId.
+        # https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html
+        key_material_id_hex = uuid.uuid5(self._internal_key_id, key_material).hex
+        return str(key_material_id_hex) * 2
+
     def calculate_and_set_arn(self, account_id, region):
         self.metadata["Arn"] = kms_key_arn(self.metadata.get("KeyId"), account_id, region)
 
@@ -420,17 +441,15 @@ class KmsKey:
 
     def derive_shared_secret(self, public_key: bytes) -> bytes:
         key_spec = self.metadata.get("KeySpec")
-        match key_spec:
-            case KeySpec.ECC_NIST_P256 | KeySpec.ECC_SECG_P256K1:
-                algorithm = hashes.SHA256()
-            case KeySpec.ECC_NIST_P384:
-                algorithm = hashes.SHA384()
-            case KeySpec.ECC_NIST_P521:
-                algorithm = hashes.SHA512()
-            case _:
-                raise InvalidKeyUsageException(
-                    f"{self.metadata['Arn']} key usage is {self.metadata['KeyUsage']} which is not valid for DeriveSharedSecret."
-                )
+        if key_spec not in (
+            KeySpec.ECC_NIST_P256,
+            KeySpec.ECC_SECG_P256K1,
+            KeySpec.ECC_NIST_P384,
+            KeySpec.ECC_NIST_P521,
+        ):
+            raise InvalidKeyUsageException(
+                f"{self.metadata['Arn']} key usage is {self.metadata['KeyUsage']} which is not valid for DeriveSharedSecret."
+            )
 
         # Deserialize public key from DER encoded data to EllipticCurvePublicKey.
         try:
@@ -438,14 +457,7 @@ class KmsKey:
         except (UnsupportedAlgorithm, ValueError):
             raise ValidationException("")
         shared_secret = self.crypto_key.key.exchange(ec.ECDH(), pub_key)
-        # Perform shared secret derivation.
-        return HKDF(
-            algorithm=algorithm,
-            salt=None,
-            info=b"",
-            length=algorithm.digest_size,
-            backend=default_backend(),
-        ).derive(shared_secret)
+        return shared_secret
 
     # This method gets called when a key is replicated to another region. It's meant to populate the required metadata
     # fields in a new replica key.
@@ -746,8 +758,16 @@ class KmsKey:
                 f"The on-demand rotations limit has been reached for the given keyId. "
                 f"No more on-demand rotations can be performed for this key: {self.metadata['Arn']}"
             )
-        self.previous_keys.append(self.crypto_key.key_material)
-        self.crypto_key = KmsCryptoKey(KeySpec.SYMMETRIC_DEFAULT)
+        current_key_material = self.crypto_key.key_material
+        pending_key_material = self.crypto_key.pending_key_material
+
+        self.previous_keys.append(current_key_material)
+
+        # If there is no pending material stored on the key, then key material will be generated.
+        self.crypto_key = KmsCryptoKey(KeySpec.SYMMETRIC_DEFAULT, pending_key_material)
+        self.metadata["CurrentKeyMaterialId"] = self.generate_key_material_id(
+            self.crypto_key.key_material
+        )
 
 
 class KmsGrant:

localstack/services/kms/provider.py

@@ -4,10 +4,13 @@ import datetime
 import logging
 import os
 
+from cbor2 import loads as cbor2_loads
 from cryptography.exceptions import InvalidTag
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes, keywrap
 from cryptography.hazmat.primitives.asymmetric import padding
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
+from cryptography.hazmat.primitives.serialization import load_der_public_key
 
 from localstack.aws.api import CommonServiceException, RequestContext, handler
 from localstack.aws.api.kms import (
@@ -135,9 +138,11 @@ from localstack.services.kms.utils import (
     validate_alias_name,
 )
 from localstack.services.plugins import ServiceLifecycleHook
+from localstack.state import StateVisitor
 from localstack.utils.aws.arns import get_partition, kms_alias_arn, parse_arn
 from localstack.utils.collections import PaginatedList
 from localstack.utils.common import select_attributes
+from localstack.utils.crypto import pkcs7_envelope_encrypt
 from localstack.utils.strings import short_uid, to_bytes, to_str
 
 LOG = logging.getLogger(__name__)
@@ -197,6 +202,9 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
     - VerifyMac
     """
 
+    def accept_state_visitor(self, visitor: StateVisitor):
+        visitor.visit(kms_stores)
+
     #
     # Helpers
     #
@@ -518,7 +526,12 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
 
         self.update_primary_key_with_replica_keys(primary_key, replica_key, replica_region)
 
-        return ReplicateKeyResponse(ReplicaKeyMetadata=replica_key.metadata)
+        # CurrentKeyMaterialId is not returned in the ReplicaKeyMetadata. May be due to not being evaluated until
+        # the key has been successfully replicated as it does not show up in DescribeKey immediately either.
+        replica_key_metadata_response = copy.deepcopy(replica_key.metadata)
+        replica_key_metadata_response.pop("CurrentKeyMaterialId", None)
+
+        return ReplicateKeyResponse(ReplicaKeyMetadata=replica_key_metadata_response)
 
     @staticmethod
     # Adds new multi region replica key to the primary key's metadata.
@@ -1075,6 +1088,25 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         self._validate_key_for_encryption_decryption(context, key)
         self._validate_key_state_not_pending_import(key)
 
+        # Handle the recipient field.  This is used by AWS Nitro to re-encrypt the plaintext to the key specified
+        # by the enclave.  Proper support for this will take significant work to figure out how to model enforcing
+        # the attestation measurements; for now, if recipient is specified and has an attestation doc in it including
+        # a public key where it's expected to be, we encrypt to that public key.  This at least allows users to use
+        # localstack as a drop-in replacement for AWS when testing without having to skip the secondary decryption
+        # when using localstack.
+        recipient_pubkey = None
+        if recipient:
+            attestation_document = recipient["AttestationDocument"]
+            # We do all of this in a try/catch and warn if it fails so that if users are currently passing a nonsense
+            # value we don't break it for them.  In the future we could do a breaking change to require a valid attestation
+            # (or at least one that contains the public key).
+            try:
+                recipient_pubkey = self._extract_attestation_pubkey(attestation_document)
+            except Exception as e:
+                logging.warning(
+                    "Unable to extract public key from non-empty attestation document: %s", e
+                )
+
         try:
             # TODO: Extend the implementation to handle additional encryption/decryption scenarios
             # beyond the current support for offline encryption and online decryption using RSA keys if key id exists in
@@ -1088,20 +1120,27 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
                 plaintext = key.decrypt(ciphertext, encryption_context)
         except InvalidTag:
             raise InvalidCiphertextException()
+
         # For compatibility, we return EncryptionAlgorithm values expected from AWS. But LocalStack currently always
         # encrypts with symmetric encryption no matter the key settings.
         #
         # We return a key ARN instead of KeyId despite the name of the parameter, as this is what AWS does and states
         # in its docs.
-        # TODO add support for "recipient"
         #  https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html#API_Decrypt_RequestSyntax
         # TODO add support for "dry_run"
-        return DecryptResponse(
+        response = DecryptResponse(
             KeyId=key.metadata.get("Arn"),
-            Plaintext=plaintext,
             EncryptionAlgorithm=encryption_algorithm,
         )
 
+        # Encrypt to the recipient pubkey if specified.  Otherwise, return the actual plaintext
+        if recipient_pubkey:
+            response["CiphertextForRecipient"] = pkcs7_envelope_encrypt(plaintext, recipient_pubkey)
+        else:
+            response["Plaintext"] = plaintext
+
+        return response
+
     def get_parameters_for_import(
         self,
         context: RequestContext,
@@ -1176,13 +1215,10 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         # TODO check if there was already a key imported for this kms key
         # if so, it has to be identical. We cannot change keys by reimporting after deletion/expiry
         key_material = self._decrypt_wrapped_key_material(import_state, encrypted_key_material)
-
-        if expiration_model:
-            key_to_import_material_to.metadata["ExpirationModel"] = expiration_model
-        else:
-            key_to_import_material_to.metadata["ExpirationModel"] = (
-                ExpirationModelType.KEY_MATERIAL_EXPIRES
-            )
+        key_material_id = key_to_import_material_to.generate_key_material_id(key_material)
+        key_to_import_material_to.metadata["ExpirationModel"] = (
+            expiration_model or ExpirationModelType.KEY_MATERIAL_EXPIRES
+        )
         if (
             key_to_import_material_to.metadata["ExpirationModel"]
             == ExpirationModelType.KEY_MATERIAL_EXPIRES
@@ -1191,12 +1227,42 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
             raise ValidationException(
                 "A validTo date must be set if the ExpirationModel is KEY_MATERIAL_EXPIRES"
             )
+        if existing_pending_material := key_to_import_material_to.crypto_key.pending_key_material:
+            pending_key_material_id = key_to_import_material_to.generate_key_material_id(
+                existing_pending_material
+            )
+            raise KMSInvalidStateException(
+                f"New key material (id: {key_material_id}) cannot be imported into KMS key "
+                f"{key_to_import_material_to.metadata['Arn']}, because another key material "
+                f"(id: {pending_key_material_id}) is pending rotation."
+            )
+
         # TODO actually set validTo and make the key expire
         key_to_import_material_to.metadata["Enabled"] = True
         key_to_import_material_to.metadata["KeyState"] = KeyState.Enabled
         key_to_import_material_to.crypto_key.load_key_material(key_material)
 
-        return ImportKeyMaterialResponse()
+        # KeyMaterialId / CurrentKeyMaterialId is only exposed for symmetric encryption keys.
+        key_material_id_response = None
+        if key_to_import_material_to.metadata["KeySpec"] == KeySpec.SYMMETRIC_DEFAULT:
+            key_material_id_response = key_to_import_material_to.generate_key_material_id(
+                key_material
+            )
+
+            # If there is no CurrentKeyMaterialId, instantly promote the pending key material to the current.
+            if key_to_import_material_to.metadata.get("CurrentKeyMaterialId") is None:
+                key_to_import_material_to.metadata["CurrentKeyMaterialId"] = (
+                    key_material_id_response
+                )
+                key_to_import_material_to.crypto_key.key_material = (
+                    key_to_import_material_to.crypto_key.pending_key_material
+                )
+                key_to_import_material_to.crypto_key.pending_key_material = None
+
+        return ImportKeyMaterialResponse(
+            KeyId=key_to_import_material_to.metadata["Arn"],
+            KeyMaterialId=key_material_id_response,
+        )
 
     def delete_imported_key_material(
         self,
@@ -1323,7 +1389,7 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         key = self._get_kms_key(account_id, region_name, key_id, any_key_state_allowed=True)
 
         response = GetKeyRotationStatusResponse(
-            KeyId=key_id,
+            KeyId=key.metadata["Arn"],
             KeyRotationEnabled=key.is_key_rotation_enabled,
             NextRotationDate=key.next_rotation_date,
         )
@@ -1415,13 +1481,13 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
 
         if key.metadata["KeySpec"] != KeySpec.SYMMETRIC_DEFAULT:
             raise UnsupportedOperationException()
-        if key.metadata["Origin"] == OriginType.EXTERNAL:
-            raise NotImplementedError("Rotation of imported keys is not supported yet.")
+        self._validate_key_state_not_pending_import(key)
+        self._validate_external_key_has_pending_material(key)
 
         key.rotate_key_on_demand()
 
         return RotateKeyOnDemandResponse(
-            KeyId=key_id,
+            KeyId=key.metadata["Arn"],
         )
 
     @handler("TagResource", expand=False)
@@ -1498,6 +1564,12 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
         if key.metadata["KeyState"] == KeyState.PendingImport:
             raise KMSInvalidStateException(f"{key.metadata['Arn']} is pending import.")
 
+    def _validate_external_key_has_pending_material(self, key: KmsKey):
+        if key.metadata["Origin"] == "EXTERNAL" and key.crypto_key.pending_key_material is None:
+            raise KMSInvalidStateException(
+                f"No available key material pending rotation for the key: {key.metadata['Arn']}."
+            )
+
     def _validate_key_for_encryption_decryption(self, context: RequestContext, key: KmsKey):
         key_usage = key.metadata["KeyUsage"]
         if key_usage != "ENCRYPT_DECRYPT":
@@ -1559,6 +1631,15 @@ class KmsProvider(KmsApi, ServiceLifecycleHook):
                     f" constraint: [Member must satisfy enum value set: {VALID_OPERATIONS}]"
                 )
 
+    def _extract_attestation_pubkey(self, attestation_document: bytes) -> RSAPublicKey:
+        # The attestation document comes as a COSE (CBOR Object Signing and Encryption) object: the CBOR
+        # attestation is signed and then the attestation and signature are again CBOR-encoded.  For now
+        # we don't bother validating the signature, though in the future we could.
+        cose_document = cbor2_loads(attestation_document)
+        attestation = cbor2_loads(cose_document[2])
+        public_key_bytes = attestation["public_key"]
+        return load_der_public_key(public_key_bytes)
+
     def _decrypt_wrapped_key_material(
         self,
         import_state: KeyImportState,