@Test
  public void kmsEnvelopeAeadDecryptWithDifferentKeyUri_fails() throws Exception {
    KeysetHandle keysetHandle =
        KeysetHandle.generateNew(
            KmsEnvelopeAeadKeyManager.createKeyTemplate(
                GCP_KMS_TEST_KEY_URI, KeyTemplates.get("AES128_CTR_HMAC_SHA256")));
    Aead aead = keysetHandle.getPrimitive(Aead.class);

    KeysetHandle keysetHandle2 =
        KeysetHandle.generateNew(
            KmsEnvelopeAeadKeyManager.createKeyTemplate(
                GCP_KMS_TEST_KEY_URI_2, KeyTemplates.get("AES128_CTR_HMAC_SHA256")));
    Aead aead2 = keysetHandle2.getPrimitive(Aead.class);

    byte[] plaintext = "plaintext".getBytes(UTF_8);
    byte[] associatedData = "associatedData".getBytes(UTF_8);

    byte[] ciphertext = aead.encrypt(plaintext, associatedData);
    byte[] ciphertext2 = aead2.encrypt(plaintext, associatedData);

    // Ciphertexts are valid.
    assertThat(aead.decrypt(ciphertext, associatedData)).isEqualTo(plaintext);
    assertThat(aead2.decrypt(ciphertext2, associatedData)).isEqualTo(plaintext);

    // Ciphertexts cannot be decrypted using a different key URI.
    assertThrows(GeneralSecurityException.class, () -> aead.decrypt(ciphertext2, associatedData));
    assertThrows(GeneralSecurityException.class, () -> aead2.decrypt(ciphertext, associatedData));
  }
Integration tests for Tink's GcpKmsClient with the real GCP Cloud KMS.
java_src/src/test/java/com/google/crypto/tink/integration/gcpkms/GcpKmsIntegrationTest.java