code: private static ContentCryptoMaterial doCreate(SecretKey cek, byte[] iv,
              EncryptionMaterials kekMaterials,
              ContentCryptoScheme contentCryptoScheme,
              S3CryptoScheme targetS3CryptoScheme,
              Provider provider,
              AWSKMS kms,
              AmazonWebServiceRequest req) {
          // Secure the envelope symmetric key either by encryption, key wrapping
          // or KMS.
          SecuredCEK cekSecured = secureCEK(cek, kekMaterials,
                  targetS3CryptoScheme.getKeyWrapScheme(),
                  targetS3CryptoScheme.getSecureRandom(),
                  provider, kms, req);
          return wrap(cek, iv, contentCryptoScheme, provider, cekSecured);
      }
docs: Returns a new instance of <code>ContentCryptoMaterial</code> for the
  given input parameters by using the specified content crypto scheme, and
  S3 crypto scheme.
  
  Note network calls are involved if the CEK is to be protected by KMS.
  
  @param cek
  content encrypting key
  @param iv
  initialization vector
  @param kekMaterials
  kek encryption material used to secure the CEK; can be KMS
  enabled.
  @param contentCryptoScheme
  content crypto scheme to be used, which can differ from the
  one of <code>targetS3CryptoScheme</code>
  @param targetS3CryptoScheme
  the target s3 crypto scheme to be used for providing the key
  wrapping scheme and mechanism for secure randomness
  @param provider
  security provider
  @param kms
  reference to the KMS client
  @param req
  the originating AWS service request