feat: AWS KMS Byok

[HatemMn]

• Introduce 2 cli actions to permit BYOK flows with AWS KMS (docs below)

• Create full flow integration tests - to avoid static mocks, utility functions that mimic (a correct) AWS KMS were created to run locally using openssl

• Fix stdout console formatting when an export action happens

Checklist

• should succeed some manual E2E tests from cli
• and some tests from the ui ( E2E )
• delete the chinese algorithm and its instances
• test valid combinations with the aws cli
• proper docs on docs.cosmian

Bonus :

added some scripts that automate the aws byok flow, they are placed with the docs and avalable to download

References :

Creating keys on amazon kms : https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-conceptual.html

Importing keys https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html

Requirements for key material :https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-conceptual.html#importing-keys-material-requirements

Closes #685
Closes #650

[HatemMn]

@copilot search this PR for "TODO" comments, useless comments, or stuff I have "forgot" around

[Copilot]

@HatemMn I've opened a new pull request, #699, to work on those changes. Once the pull request is ready, I'll request review from you.

[HatemMn]

Documentation isn't finished yet but it's just a matter of redaction

The CLI, the UI, and the integration tests are all finished tho

For now the only problem here is that, for some reason, when using an algorithm other that RSAES_OAEP_SHA_256 to wrap the AWS KMS returns an "invalid cyphertext error"...

Until this is fixed I can safely say that RSAES_OAEP_SHA_256 wrapping is correctly implemented if an AWS BYOK use case is needed by someone, but please don't use the other ones before this is finished

[Copilot]

Pull request overview

Adds AWS KMS BYOK support across the UI, CLI, docs, and CLI integration tests, including utilities to simulate AWS import/unwrapping locally via OpenSSL.

Changes:

• Adds AWS BYOK UI screens (import KEK + export key material) and navigation/routes.
• Introduces CLI kms aws byok {import,export} commands and OpenSSL-based integration tests.
• Updates documentation navigation and adds AWS BYOK docs + downloadable helper scripts.

Reviewed changes

Copilot reviewed 34 out of 38 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
ui/src/menuItems.tsx	Adds AWS section entries in the UI menu.
ui/src/components/ExternalLink.tsx	Introduces a reusable external link component.
ui/src/CseInfo.tsx	Replaces raw <a> with ExternalLink.
ui/src/AzureImportKek.tsx	Replaces raw <a> with ExternalLink.
ui/src/AwsImportKek.tsx	Adds UI flow to import AWS KEK (file/base64) into KMS.
ui/src/AwsExportKeyMaterial.tsx	Adds UI flow to export wrapped key material for AWS import.
ui/src/App.tsx	Registers AWS routes and components.
documentation/mkdocs.yml	Adds AWS BYOK page and adjusts AWS doc paths.
documentation/docs/index.md	Adds AWS BYOK link + minor punctuation/wording tweaks.
documentation/docs/azure/byok/byok.md	Switches TOC to [TOC] macro.
documentation/docs/aws/byok.md	New AWS BYOK documentation page + script download links.
documentation/docs/aws/byok_scripts/*.sh	Adds scripts to automate AWS BYOK flows (RSA/ECC/AES).
crate/server/src/main.rs	Removes aws_xks_kek_user from embedded sample config.
crate/cli/src/tests/kms/shared/openssl_utils.rs	Adds OpenSSL helpers to simulate unwrap/import steps in tests.
crate/cli/src/tests/kms/shared/mod.rs	Exposes openssl_utils in test shared module.
crate/cli/src/tests/kms/mod.rs	Adds AWS test module.
crate/cli/src/tests/kms/azure/mod.rs	Reuses OpenSSL helpers & adds unwrap verification for Azure BYOK export.
crate/cli/src/tests/kms/aws/*	Adds AWS BYOK integration tests.
crate/cli/src/lib.rs	Allows additional clippy lint in tests.
crate/cli/src/actions/kms/shared/import_key.rs	Improves stdout success message punctuation.
crate/cli/src/actions/kms/console.rs	Adjusts stdout formatting/spacing and adds trailing blank line.
crate/cli/src/actions/kms/azure/byok/export_byok.rs	Fixes unwrap flag so wrapping key is applied.
crate/cli/src/actions/kms/aws/*	Adds AWS command modules + BYOK import/export implementation.
crate/cli/src/actions/kms/actions.rs	Registers kms aws commands.
crate/cli/src/actions/kms/aws/README.ms	Adds (temporary) AWS notes file.
.vscode/settings.json	Adds “Byok” to cSpell dictionary.

Comments suppressed due to low confidence (3)

ui/src/AwsImportKek.tsx:1

• The RsaOaepSha256 and RsaAesKeyWrapSha256 string values don’t encode the SHA-256 suffix while the SHA-1 variants do. Given the comment that these MUST match a kebab-case serialization, this asymmetry is a strong indicator of a mismatch that could select the wrong wrapping algorithm at export time. Align the string literals so SHA-256 values are explicitly represented (or source them from a single shared mapping that matches the Rust/wasm side).
  ui/src/AwsExportKeyMaterial.tsx:1
• Using String.fromCharCode(...wrappedKeyBytes) spreads the entire byte array into function arguments, which can throw (or be very slow) for larger buffers due to argument/stack limits. Prefer a chunked conversion or a dedicated bytes→base64 utility to avoid crashes when exporting larger wrapped key blobs.
  ui/src/AwsExportKeyMaterial.tsx:1
• The sentence is grammatically incomplete (“imported into” is missing its object). Consider rewording to explicitly mention AWS KMS, e.g. “...to be imported into AWS KMS.”

[Manuthor]

Great job!

[Copilot]

@HatemMn I've opened a new pull request, #743, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

@HatemMn I've opened a new pull request, #744, to work on those changes. Once the pull request is ready, I'll request review from you.

[HatemMn]

Thanks for the review

You will notice some unexpected changes :

• Commented code in files unrealated to AWS because I deleted a "deadcode" clippy directive and it flagged dead code that's not mone so I just commented it
• new copilot instructions to avoid some false negatives

[Copilot]

@HatemMn I've opened a new pull request, #792, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

Pull request overview

Copilot reviewed 40 out of 45 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (3)

ui/src/AwsImportKek.tsx:1

• The SHA-256 variants omit the hash suffix in their serialized values (rsa-oaep, rsa-aes-key-wrap), while the SHA-1 variants include it. Given the comment that these strings MUST match Rust strum kebab-case serialization, this asymmetry is a concrete risk of sending an unsupported/incorrect wrapping algorithm to wasm.export_ttlv_request and mis-tagging imported KEKs. Align the serialized values to the exact Rust enum serialization (e.g., include -sha256 if that’s what Rust produces), and keep labels/values consistent across SHA-1/SHA-256 variants.
  ui/src/AwsExportKeyMaterial.tsx:1
• Encoding with String.fromCharCode(...wrappedKeyBytes) can throw (Maximum call stack size exceeded) or behave poorly for larger byte arrays because it spreads the entire buffer into function arguments. Use a chunked conversion (or a dedicated bytes->base64 helper) to safely handle arbitrary key sizes.
  ui/src/AwsExportKeyMaterial.tsx:1
• Typing these wasm-parsed structures as Map<string, never> forces pervasive casting and makes the code harder to reason about (and easy to break with refactors). Use a more accurate type (or unknown + narrow via runtime checks) for attributes / vendor_attributes / AttributeValue so the JSON parsing path is type-safe and self-documenting.