I’m working with the AWS Encryption SDK for .NET and using AWS KMS Hierarchical Keyrings to manage encryption and decryption in my application. Specifically, I’m trying to construct a hierarchical keyring using the CreateAwsKmsHierarchicalKeyring method.

Here’s my code for constructing the keyring:

 private async Task<IKeyring> ConstructKeyRingAsync(string keyArn, CancellationToken cancellationToken){

 // Configure a new key store service
 var kmsConfig = new KMSConfiguration { KmsKeyArn = keyArn };
 var keystoreConfig = new KeyStoreConfig
 {
     KmsClient = _amazonClientFactory.GetKeyManagementService(credentials),
     KmsConfiguration = kmsConfig,
     DdbTableName = "keyStoreName",
     DdbClient = _amazonClientFactory.GetAmazonDynamoDb(credentials),
     LogicalKeyStoreName = "logicalKeyStoreName"
 };
 var keystore = new KeyStore(keystoreConfig);

 // Call CreateKeyStore to create a branch key store
 keystore.CreateKeyStore(new CreateKeyStoreInput());

 var branchKeyId = keystore.CreateKey(new CreateKeyInput());

 // rotate your active branch key
 keystore.VersionKey(new VersionKeyInput { BranchKeyIdentifier = branchKeyId.BranchKeyIdentifier });

 var kmsKeyringInput = new CreateAwsKmsHierarchicalKeyringInput
 {
     KeyStore = keystore,
     BranchKeyId = branchKeyId.BranchKeyIdentifier,
     Cache = new CacheType { Default = new DefaultCache { EntryCapacity = 1000 } },
     TtlSeconds = 600
 };

 var result = _materialProviders.CreateAwsKmsHierarchicalKeyring(kmsKeyringInput);

 return result;
}

My Queries:

Key Store Existence: How can I ensure that CreateKeyStore is only called if the key store doesn’t already exist?

Branch Key Existence: Similarly, how can I check if a branch key already exists in the key store before calling CreateKey? I need a way to ensure I’m not creating duplicate branch keys or rotating them unnecessarily.

What is the recommended approach to handle this scenario in AWS KMS Hierarchical Keyrings using the AWS Encryption SDK?

Any guidance or suggestions on how to handle this properly would be much appreciated!