code: private static ContentCryptoMaterial doCreate(SecretKey cek, byte[] iv,
                                                    EncryptionMaterials kekMaterials,
                                                    ContentCryptoScheme contentCryptoScheme,
                                                    S3CryptoScheme targetS3CryptoScheme,
                                                    CryptoConfiguration config,
                                                    AWSKMS kms,
                                                    AmazonWebServiceRequest req) {
          // Secure the envelope symmetric key either by encryption, key wrapping
          // or KMS.
          SecuredCEK cekSecured = secureCEK(cek, kekMaterials,
                                            targetS3CryptoScheme.getKeyWrapScheme(),
                                            config, kms, req);
          return wrap(cek, iv, contentCryptoScheme, config.getCryptoProvider(),
                      config.getAlwaysUseCryptoProvider(), cekSecured);
      }
docs: Returns a new instance of <code>ContentCryptoMaterial</code> for the
  given input parameters by using the specified content crypto scheme, and
  S3 crypto scheme.
  
  Note network calls are involved if the CEK is to be protected by KMS.
  
  @param cek
  content encrypting key
  @param iv
  initialization vector
  @param kekMaterials
  kek encryption material used to secure the CEK; can be KMS
  enabled.
  @param contentCryptoScheme
  content crypto scheme to be used, which can differ from the
  one of <code>targetS3CryptoScheme</code>
  @param targetS3CryptoScheme
  the target s3 crypto scheme to be used for providing the key
  wrapping scheme and mechanism for secure randomness
  @param config
  crypto configuration
  @param kms
  reference to the KMS client
  @param req
  the originating AWS service request