@Test
  public void twoKmsAeads_canOnlyDecryptTheirOwnCiphertext() throws Exception {
    String keyName = "projects/tink-test/locations/global/keyRings/unit-test/cryptoKeys/aead-key";
    String keyName2 = "projects/tink-test/locations/global/keyRings/unit-test/cryptoKeys/aead-key2";
    FakeCloudKms fakeKms = new FakeCloudKms(asList(keyName, keyName2));

    byte[] plaintext = "plaintext".getBytes(UTF_8);
    byte[] associatedData = "associatedData".getBytes(UTF_8);

    Aead kmsAead = new GcpKmsAead(fakeKms, keyName);
    byte[] ciphertext = kmsAead.encrypt(plaintext, associatedData);

    Aead kmsAead2 = new GcpKmsAead(fakeKms, keyName2);
    byte[] ciphertext2 = kmsAead2.encrypt(plaintext, associatedData);

    assertThat(kmsAead.decrypt(ciphertext, associatedData)).isEqualTo(plaintext);
    assertThat(kmsAead2.decrypt(ciphertext2, associatedData)).isEqualTo(plaintext);

    assertThrows(
        GeneralSecurityException.class, () -> kmsAead2.decrypt(ciphertext, associatedData));
    assertThrows(
        GeneralSecurityException.class, () -> kmsAead.decrypt(ciphertext2, associatedData));
  }
This rule manages automatic graceful shutdown for the registered servers and channels.
java_src/src/test/java/com/google/crypto/tink/integration/gcpkms/GcpKmsAeadTest.java