chore: Clean up TODOs (#214)

lavaleri · web-flow · commit cb4bc2b92efc · 2023-05-24T15:45:06.000-07:00
diff --git a/.github/workflows/ci_examples_java.yml b/.github/workflows/ci_examples_java.yml
@@ -28,7 +28,7 @@ jobs:
     # Don't run the nightly build on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'awslabs'
     strategy:
-      max-parallel: 1 # TODO: Fix jobs failing when running in parallel
+      max-parallel: 1
       matrix:
         java-version: [ 8, 11, 16, 17 ]
         os: [
diff --git a/DynamoDbEncryption/dafny/StructuredEncryption/src/AwsCryptographyDbEncryptionSdkStructuredEncryptionOperations.dfy b/DynamoDbEncryption/dafny/StructuredEncryption/src/AwsCryptographyDbEncryptionSdkStructuredEncryptionOperations.dfy
@@ -344,31 +344,25 @@ module AwsCryptographyDbEncryptionSdkStructuredEncryptionOperations refines Abst
     )
   }
 
-  // TODO this is a workaround for a very silly issue with case sensitivity between package names,
-  // that prevents this code from always correctly finding `dafny.Function4`.
-  // For now, put all inputs into one datatype so we are only using `dafny.Function1` here.
-  datatype CanonizeForDecryptInput = CanonizeForDecryptInput(
+  // construct the DecryptCanon
+  function method {:opaque} {:vcs_split_on_every_assert} CanonizeForDecrypt(
     tableName: GoodString,
     data: StructuredDataPlain,
     authSchema: AuthSchemaPlain,
     legend: Header.Legend
-  )
-
-  // construct the DecryptCanon
-  function method {:opaque} {:vcs_split_on_every_assert} CanonizeForDecrypt(input: CanonizeForDecryptInput)
-    : (ret : Result<DecryptCanon, Error>)
-    requires input.authSchema.Keys == input.data.Keys
+  ) : (ret : Result<DecryptCanon, Error>)
+    requires authSchema.Keys == data.Keys
     ensures ret.Success? ==>
-      && |ret.value.signedFields_c| == |input.legend|
+      && |ret.value.signedFields_c| == |legend|
     ensures ret.Success? ==>
-      && (forall k :: k in input.data.Keys && input.authSchema[k].content.Action.SIGN? ==> Paths.SimpleCanon(input.tableName, k) in ret.value.data_c.Keys)
+      && (forall k :: k in data.Keys && authSchema[k].content.Action.SIGN? ==> Paths.SimpleCanon(tableName, k) in ret.value.data_c.Keys)
     ensures ret.Success? ==>
-      && (forall v :: v in ret.value.data_c.Values ==> v in input.data.Values)
+      && (forall v :: v in ret.value.data_c.Values ==> v in data.Values)
     ensures ret.Success? ==>
       && ret.value.cryptoSchema.content.SchemaMap?
       && CryptoSchemaMapIsFlat(ret.value.cryptoSchema.content.SchemaMap)
-      && AuthSchemaIsFlat(input.authSchema)
-      && ValidParsedCryptoSchema(ret.value.cryptoSchema.content.SchemaMap, input.authSchema, input.tableName)
+      && AuthSchemaIsFlat(authSchema)
+      && ValidParsedCryptoSchema(ret.value.cryptoSchema.content.SchemaMap, authSchema, tableName)
   {
     //= specification/structured-encryption/decrypt-structure.md#calculate-signed-and-encrypted-field-lists
     //# The `signed field list` MUST be all fields for which
@@ -378,18 +372,18 @@ module AwsCryptographyDbEncryptionSdkStructuredEncryptionOperations refines Abst
     //# sorted by the [Canonical Path](header.md.#canonical-path).
 
     reveal Maps.Injective();
-    Paths.SimpleCanonUnique(input.tableName);
-    var fieldMap := map k <- input.data | input.authSchema[k].content.Action == SIGN ::
-      Paths.SimpleCanon(input.tableName, k) := k;
+    Paths.SimpleCanonUnique(tableName);
+    var fieldMap := map k <- data | authSchema[k].content.Action == SIGN ::
+      Paths.SimpleCanon(tableName, k) := k;
     assert Maps.Injective(fieldMap);
 
-    var data_c := map k <- fieldMap :: k := input.data[fieldMap[k]];
+    var data_c := map k <- fieldMap :: k := data[fieldMap[k]];
     var signedFields_c := SortedSets.ComputeSetToOrderedSequence2(data_c.Keys, ByteLess);
 
-    if |input.legend| < |signedFields_c| then
+    if |legend| < |signedFields_c| then
       Failure(E("Schema changed : something that was unsigned is now signed."))
     else 
-    if |input.legend| > |signedFields_c| then
+    if |legend| > |signedFields_c| then
       Failure(E("Schema changed : something that was signed is now unsigned."))
     else
 
@@ -398,11 +392,11 @@ module AwsCryptographyDbEncryptionSdkStructuredEncryptionOperations refines Abst
     //# for which the corresponding byte in the [Encrypt Legend](header.md.#encrypt-legend)
     //# is `0x65` indicating [Encrypt and Sign](header.md.#encrypt-legend-bytes),
     //# sorted by the field's [canonical path](./header.md#canonical-path).
-    var encFields_c : seq<CanonicalPath> := FilterEncrypted(signedFields_c, input.legend);
+    var encFields_c : seq<CanonicalPath> := FilterEncrypted(signedFields_c, legend);
     :- Need(|encFields_c| < (UINT32_LIMIT / 3), E("Too many encrypted fields."));
 
     var actionMap := map k <- fieldMap ::
-      fieldMap[k] := if Paths.SimpleCanon(input.tableName, fieldMap[k]) in encFields_c then
+      fieldMap[k] := if Paths.SimpleCanon(tableName, fieldMap[k]) in encFields_c then
         CryptoSchema(
           content := CryptoSchemaContent.Action(ENCRYPT_AND_SIGN),
           attributes := None
@@ -815,8 +809,7 @@ module AwsCryptographyDbEncryptionSdkStructuredEncryptionOperations refines Abst
     var ok :- head.verifyCommitment(config.primitives, postCMMAlg, commitKey, headerSerialized);
 
     :- Need(ValidString(input.tableName), E("Bad Table Name"));
-    var canonData :- CanonizeForDecrypt(
-      CanonizeForDecryptInput(input.tableName, encRecord, authSchema, head.legend));
+    var canonData :- CanonizeForDecrypt(input.tableName, encRecord, authSchema, head.legend);
 
     //= specification/structured-encryption/decrypt-structure.md#calculate-signed-and-encrypted-field-lists
     //= type=implication
@@ -899,7 +892,7 @@ module AwsCryptographyDbEncryptionSdkStructuredEncryptionOperations refines Abst
     output := Success(decryptOutput);
   }
 
-  // TODO This is here temporarially until it gets merged into the standard library
+  // predicates/lemmas like this are not yet provided out of the box in the standard library.
   predicate {:opaque} Contains<X, Y>(big: map<X, Y>, small: map<X, Y>)
   {
     && small.Keys <= big.Keys
diff --git a/DynamoDbEncryption/dafny/StructuredEncryption/test/Paths.dfy b/DynamoDbEncryption/dafny/StructuredEncryption/test/Paths.dfy
@@ -10,21 +10,22 @@ module PathsTests {
   import opened StructuredEncryptionPaths
 
   method {:test} TestSpecExamples() {
-    /*
-    TODO - remake these tests without the parsing step
-
     var tableName : GoodString := "example_table";
     assert(ValidString("example_table"));
-    var nameSrc :- expect MakeTerminalLocation("name");
-    expect nameSrc.canonicalPath(tableName) == 
+    var name := Selector.Map("name");
+    var pathToTest := TerminalLocation([name]);
+    expect pathToTest.canonicalPath(tableName) == 
          UTF8.EncodeAscii("example_table")
       + [0,0,0,0,0,0,0,1] // depth
       + ['$' as uint8] // map
       + [0,0,0,0,0,0,0,4] // length
       + UTF8.EncodeAscii("name");
 
-    var stampSrc :- expect MakeTerminalLocation("status-history[0].timestamp");
-    expect stampSrc.canonicalPath(tableName) == 
+    var history := Selector.Map("status-history");
+    var index := Selector.List(0);
+    var timestamp := Selector.Map("timestamp");
+    var pathToTest2 := TerminalLocation([history, index, timestamp]);
+    expect pathToTest2.canonicalPath(tableName) == 
         UTF8.EncodeAscii("example_table")
       + [0,0,0,0,0,0,0,3] // depth
       + ['$' as uint8] // map
@@ -35,6 +36,5 @@ module PathsTests {
       + ['$' as uint8] // map
       + [0,0,0,0,0,0,0,9] // length of "timestamp"
       + UTF8.EncodeAscii("timestamp");
-  */
   }
 }
diff --git a/DynamoDbEncryption/runtimes/java/src/test/sdkv1/com/amazonaws/services/dynamodbv2/datamodeling/TransformerHolisticIT.java b/DynamoDbEncryption/runtimes/java/src/test/sdkv1/com/amazonaws/services/dynamodbv2/datamodeling/TransformerHolisticIT.java
@@ -618,7 +618,6 @@ public void leadingAndTrailingZeros() {
 
     mapper.save(obj);
 
-    // TODO: Update the mock to handle this appropriately.
     // DynamoDb discards leading and trailing zeros from numbers
     Map<String, AttributeValue> key = new HashMap<String, AttributeValue>();
     key.put(HASH_KEY, new AttributeValue().withN("0"));
diff --git a/Examples/runtimes/java/DynamoDbEncryption/.gitignore b/Examples/runtimes/java/DynamoDbEncryption/.gitignore
@@ -3,3 +3,5 @@
 
 # Ignore Gradle build output directory
 build
+
+*.pem
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/BasicPutGetExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/BasicPutGetExample.java
@@ -102,10 +102,8 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
                 // `ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384` suite,
                 // which includes AES-GCM with key derivation, signing, and key commitment.
                 // This is also the default algorithm suite if one is not specified in this config.
-                // For more information on supported algorithm suites, see
-                //   TODO: Add DB ESDK-specific link, similar to
-                //   https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/supported-algorithms.html,
-                //   but with accurate information for DB ESDK
+                // For more information on supported algorithm suites, see:
+                //   https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/supported-algorithms.html
                 .algorithmSuiteId(
                     DBEAlgorithmSuiteId.ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384)
                 .build();
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/clientsupplier/ClientSupplierExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/clientsupplier/ClientSupplierExample.java
@@ -248,9 +248,6 @@ public static void ClientSupplierPutItemGetItem(String ddbTableName, String keyA
         assert 200 == onlyReplicaKeyGetResponse.sdkHttpResponse().statusCode();
         final Map<String, AttributeValue> onlyReplicaKeyReturnedItem = onlyReplicaKeyGetResponse.item();
         assert onlyReplicaKeyReturnedItem.get("sensitive_data").s().equals("encrypt and sign me!");
-
-        // TODO: After adding MissingRegionException, give an example with a fake region
-        // demonstrating that MissingRegionException extends AwsCryptographicMaterialProvidersException
     }
 
     public static void main(final String[] args) {
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/clientsupplier/RegionalRoleClientSupplier.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/clientsupplier/RegionalRoleClientSupplier.java
@@ -28,9 +28,6 @@ public RegionalRoleClientSupplier() {
   @Override
   public KmsClient GetClient(GetClientInput getClientInput) {
     if (!config.regionIamRoleMap.containsKey(getClientInput.region())) {
-      // TODO: Create a MissingRegionException that extends AwsCryptographicMaterialProvidersException.
-      // The generated code for AwsCryptographicMaterialProvidersException cannot be extended as-is,
-      // as its constructor requires access to a class private to itself.
       throw new RuntimeException("Missing region");
     }
 
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/enhanced/EnhancedPutGetExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/enhanced/EnhancedPutGetExample.java
@@ -100,10 +100,8 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
                         // `ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384` suite,
                         // which includes AES-GCM with key derivation, signing, and key commitment.
                         // This is also the default algorithm suite if one is not specified in this config.
-                        // For more information on supported algorithm suites, see
-                        //   TODO: Add DB ESDK-specific link, similar to
-                        //   https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/supported-algorithms.html,
-                        //   but with accurate information for DB ESDK
+                        // For more information on supported algorithm suites, see:
+                        //   https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/supported-algorithms.html
                         .algorithmSuiteId(
                             DBEAlgorithmSuiteId.ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384)
                         .build());
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/itemencryptor/ItemEncryptDecryptExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/itemencryptor/ItemEncryptDecryptExample.java
@@ -105,10 +105,8 @@ public static void PutItemGetItem(String kmsKeyId, String ddbTableName) {
                 // `ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384` suite,
                 // which includes AES-GCM with key derivation, signing, and key commitment.
                 // This is also the default algorithm suite if one is not specified in this config.
-                // For more information on supported algorithm suites, see
-                //   TODO: Add DB ESDK-specific link, similar to
-                //   https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/supported-algorithms.html,
-                //   but with accurate information for DB ESDK
+                // For more information on supported algorithm suites, see:
+                //   https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/supported-algorithms.html
                 .algorithmSuiteId(
                     DBEAlgorithmSuiteId.ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384)
                 .build();
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/BasicSearchableEncryptionExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/BasicSearchableEncryptionExample.java
@@ -70,7 +70,7 @@ public static void PutItemQueryItemWithBeacon(String ddbTableName, String branch
     //    The beacon name must be the name of a table attribute that will be encrypted.
     //    The `length` parameter dictates how many bits are in the beacon attribute value.
     //    The following link provides guidance on choosing a beacon length:
-    //    TODO: add link
+    //        https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/choosing-beacon-length.html
     List<StandardBeacon> standardBeaconList = new ArrayList<>();
 
     // The configured DDB table has a GSI on the `aws_dbe_b_state` AttributeName
@@ -151,8 +151,8 @@ public static void PutItemQueryItemWithBeacon(String ddbTableName, String branch
     //        statically configures a single beaconKey. That is the approach this example takes.
     //        For use cases where you want to use different beacon keys depending on the data
     //        (for example if your table holds data for multiple tenants, and you want to use
-    //        a different beacon key per tenant), look into configuring a Multi Beacon Key.
-    //        Source: TODO example
+    //        a different beacon key per tenant), look into configuring a MultiKeyStore:
+    //          https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/searchable-encryption-multitenant.html
     List<BeaconVersion> beaconVersions = new ArrayList<>();
     beaconVersions.add(
         BeaconVersion.builder()
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/VirtualBeaconSearchableEncryptionExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/VirtualBeaconSearchableEncryptionExample.java
@@ -48,8 +48,8 @@
   In general, if you wish to use a field with only a handful possible values, it is suggested
   to construct a virtual field to enable effective querying while obfuscating underlying data.
 
-  For more information on virtual fields, see
-    TODO: Add docs link
+  For more information on virtual fields, see:
+    https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/beacons.html#virtual-field
 
   This example follows a use case of a database that stores customer location data. This is an
   extension of the "BasicSearchableEncryptionExample" in this directory. This example uses the same
@@ -69,9 +69,9 @@
   properties on our table:
    1. Obfuscate whether a record's `hasSensitiveData` attribute is `true` or `false`
    2. Query against a combination of whether `hasSensitiveData` is true/false and the `state` field
-  We could not achieve these properties with a standard beacon on an true/false attribute.Following
-  the guidance to choose a beacon length:
-    TODO: link
+  We could not achieve these properties with a standard beacon on an true/false attribute
+  Following the guidance to choose a beacon length:
+    https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/choosing-beacon-length.html
   For a boolean value (in our case, whether `hasSensitiveData` is true or false), the acceptable
   bounds for beacon length are either 0 or 1. This corresponds to either not storing a beacon
   (length 0), or effectively directly storing an true/false attribute (length 1). With
@@ -170,7 +170,7 @@ public static void PutItemQueryItemWithVirtualBeacon(String ddbTableName, String
     //      (2 possible values: true/false hasSensitiveData field), we expect a population size of
     //      (56 * 2 = 112) possible values.
     //    The following link provides guidance on choosing a beacon length:
-    //       TODO: add link
+    //       https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/choosing-beacon-length.html
     //    We follow the guidance in the link above to determine acceptable bounds for beacon length:
     //     - min: log(sqrt(112))/log(2) ~= 3.4, round up to 4
     //     - max: log((112/2))/log(2) ~= 5.8, round up to 6
@@ -223,8 +223,8 @@ public static void PutItemQueryItemWithVirtualBeacon(String ddbTableName, String
     //        statically configures a single beaconKey. That is the approach this example takes.
     //        For use cases where you want to use different beacon keys depending on the data
     //        (for example if your table holds data for multiple tenants, and you want to use
-    //        a different beacon key per tenant), look into configuring a Multi Beacon Key.
-    //        Source: TODO example
+    //        a different beacon key per tenant), look into configuring a MultiKeyStore:
+    //          https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/searchable-encryption-multitenant.html
     //    We also provide our standard beacon list and virtual fields here.
     List<BeaconVersion> beaconVersions = new ArrayList<>();
     beaconVersions.add(
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/complexexample/BeaconConfig.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/complexexample/BeaconConfig.java
@@ -34,8 +34,7 @@ public class BeaconConfig {
 
   /*
    * This file sets up all the searchable encryption configuration required to execute the examples from
-   * https://github.com/aws-samples/searchable-encryption-dynamodb-howto/blob/main/BeaconPOC/Demo.md
-   * using the encryption client.
+   * our workshop using the encryption client.
    */
 
   public static DynamoDbClient SetupBeaconConfig(String ddbTableName, String branchKeyId, String branchKeyWrappingKmsKeyArn, String branchKeyDdbTableName) {
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/complexexample/PutRequests.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/complexexample/PutRequests.java
@@ -8,8 +8,7 @@
 import software.amazon.awssdk.services.dynamodb.model.PutItemRequest;
 
 /*
- * This class implements PutItem calls to populate a DDB table with items from
- * https://github.com/aws-samples/searchable-encryption-dynamodb-howto/blob/main/BeaconPOC/plain_json
+ * This class implements PutItem calls to populate a DDB table with items from our workshop.
  * By providing a DynamoDbClient that is configured to use searchable encryption,
  *   this class will encrypt the data client side and add beacon attributes to the items.
  * This only implements a single item of each of the 6 record types from Demo.md. Adding the remaining
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/complexexample/QueryRequests.java b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/complexexample/QueryRequests.java
@@ -10,8 +10,7 @@
 import software.amazon.awssdk.services.dynamodb.model.QueryResponse;
 
 /*
- * This class implements query access patterns from
- * https://github.com/aws-samples/searchable-encryption-dynamodb-howto/blob/main/BeaconPOC/Demo.md
+ * This class implements query access patterns from our workshop.
  * The queries in this file are more complicated than in other searchable encryption examples,
  *   and should demonstrate how one can structure queries on beacons in a broader variety of applications.
  * Currently, only queries 1-8, and 13-14 are implemented. These queries cover all 6 record types and all 4 GSIs
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/complexexample/README.md b/Examples/runtimes/java/DynamoDbEncryption/src/main/java/software/amazon/cryptography/examples/searchableencryption/complexexample/README.md
@@ -4,11 +4,6 @@ This example uses a more complex searchable encryption configuration than other
 This is intended to demonstrate how to set up a more complicated searchable encryption configuration.
 This also walks through some example query expressions one can use to search their encrypted data.
 
-## TODO: Demo repo is private. This should be made public.
-
-This example is based off of a use case described in [Demo.md](https://github.com/aws-samples/searchable-encryption-dynamodb-howto/blob/main/BeaconPOC/Demo.md#changes-for-encryption).
-This example demonstrates a use case where a single DDB table stores multiple different record types under the same schema.
-
 ```
 .
 ├── ComplexSearchableEncryptionExample // Main entry point for example
@@ -17,4 +12,4 @@ This example demonstrates a use case where a single DDB table stores multiple di
 ├── PutRequests // QUERY requests executed on the DDB table
 ├── BeaconConfig // Sets up beacons and searchable encryption configuration
 └── README.md
-```
+```
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/keyring/TestHierarchicalKeyringExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/keyring/TestHierarchicalKeyringExample.java
@@ -19,7 +19,6 @@ public void TestHierarchicalKeyringExample() throws InterruptedException {
 
         // Key creation is eventually consistent, so wait 5 seconds to decrease the likelihood
         // our test fails due to eventual consistency issues.
-        // TODO: poll the table, with retries and backoff, to do this more elegantly.
         Thread.sleep(5000);
 
         HierarchicalKeyringExample.HierarchicalKeyringGetItemPutItem(
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/searchableencryption/TestBasicSearchableEncryptionExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/searchableencryption/TestBasicSearchableEncryptionExample.java
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/searchableencryption/TestCompoundBeaconSearchableEncryptionExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/searchableencryption/TestCompoundBeaconSearchableEncryptionExample.java
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/searchableencryption/TestVirtualBeaconSearchableEncryptionExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/searchableencryption/TestVirtualBeaconSearchableEncryptionExample.java
diff --git a/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/searchableencryption/complexexample/TestComplexSearchableEncryptionExample.java b/Examples/runtimes/java/DynamoDbEncryption/src/test/java/software/amazon/cryptography/examples/searchableencryption/complexexample/TestComplexSearchableEncryptionExample.java
diff --git a/Makefile b/Makefile

-Original file line number
+Diff line change
 # Ignore Gradle build output directory
 build
++
 +*.pem
Original file line number	Diff line number	Diff line change
`@@ -248,9 +248,6 @@ public static void ClientSupplierPutItemGetItem(String ddbTableName, String keyA`
`248`	`248`	`assert 200 == onlyReplicaKeyGetResponse.sdkHttpResponse().statusCode();`
`249`	`249`	`final Map<String, AttributeValue> onlyReplicaKeyReturnedItem = onlyReplicaKeyGetResponse.item();`
`250`	`250`	`assert onlyReplicaKeyReturnedItem.get("sensitive_data").s().equals("encrypt and sign me!");`
`251`		`-`
`252`		`- // TODO: After adding MissingRegionException, give an example with a fake region`
`253`		`- // demonstrating that MissingRegionException extends AwsCryptographicMaterialProvidersException`
`254`	`251`	`}`
`255`	`252`
`256`	`253`	`public static void main(final String[] args) {`
Original file line number	Diff line number	Diff line change
`@@ -28,9 +28,6 @@ public RegionalRoleClientSupplier() {`
`28`	`28`	`@Override`
`29`	`29`	`public KmsClient GetClient(GetClientInput getClientInput) {`
`30`	`30`	`if (!config.regionIamRoleMap.containsKey(getClientInput.region())) {`
`31`		`- // TODO: Create a MissingRegionException that extends AwsCryptographicMaterialProvidersException.`
`32`		`- // The generated code for AwsCryptographicMaterialProvidersException cannot be extended as-is,`
`33`		`- // as its constructor requires access to a class private to itself.`
`34`	`31`	`throw new RuntimeException("Missing region");`
`35`	`32`	`}`
`36`	`33`