func (e *KMS) Encrypt(secret []byte) (*EncryptedData, error) {
	resp, err := e.svc.GenerateDataKey(&kms.GenerateDataKeyInput{
		KeyId:         &e.keyID,
		NumberOfBytes: aws.Int64(e.KeySize),
	})
	if err != nil {
		return nil, err
	}
	enc, err := e.Provider(resp.Plaintext)
	if err != nil {
		return nil, err
	}
	data, err := enc.Encrypt(secret)
	if err != nil {
		return nil, err
	}
	if data.Context == nil {
		data.Context = map[string]interface{}{}
	}
	data.Context["kms_type"] = data.Type
	data.Type = KMSWrapped
	data.Context["kms_key"] = resp.CiphertextBlob
	return data, nil
}
Encrypt generates a new encryption key using Amazon KMS, passing it to the
configured EncryptionProvider as the encryption key to encrypt the secret.
package encryptor
import (
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/kms"
)
type KMS struct {
	svc      kmsInterface
	keyID    string
	KeySize  int64
	Provider EncryptionProvider
}
type kmsInterface interface {
	GenerateDataKey(input *kms.GenerateDataKeyInput) (*kms.GenerateDataKeyOutput, error)
	Decrypt(input *kms.DecryptInput) (*kms.DecryptOutput, error)
}
func NewKMS(keyID, region string) *KMS {
	builder := func(key []byte) (EncryptDecryptor, error) {
		if len(key) < 64 {
			return nil, ErrKeyTooShort
		}
		return NewAES(key[:32], key[32:])
	}
	return &KMS{
		svc:      kms.New(session.New(), &aws.Config{Region: aws.String(region)}),
		keyID:    keyID,
		KeySize:  64,
		Provider: builder,
	}
}