Client-side KMS reencryption
Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks. The `reencrypt` APIs allow decryption followed by reencryption on the server side. This is more efficient and secure.
def kms_reencrypt_noncompliant():
    import boto3
    import base64
    client = boto3.client('kms')
    plaintext = client.decrypt(
        CiphertextBlob=bytes(base64.b64decode("secret"))
    )
    # Noncompliant: decrypt is immediately followed by encrypt.
    response = client.encrypt(
        KeyId='string',
        Plaintext=plaintext
    )
    return response
def kms_reencrypt_compliant():
    import boto3
    import base64
    client = boto3.client('kms')
    # Compliant: server-side reencryption.
    response = client.re_encrypt(
        CiphertextBlob=bytes(base64.b64decode("secret")),
        DestinationKeyId="string",
    )
    return response