class_docstr: Encapsulation for a set of credentials.
  
  When storing to or loading from a Driver, the raw credentials data may or may not be encrypted
  (e.g. when writing to disk, we should always keep it encrypted). To allow Credentials to be
  passed from Driver to Driver without excessive calls to KMS.encrypt/decrypt, this "data" in
  the Credentials can be either encrypted or not. It is up to the code that constructs the
  Credentials object to know which.
  
  When retrieving the raw, unencrypted data from a Credentials object, use the following code:
  
      if credentials.is_encrypted():
          return credentials.get_data_kms_decrypted()
      else:
          return credentials.data()
class_docstr_tok: ["Encapsulation","for","a","set","of","credentials",".","When","storing","to","or","loading","from","a","Driver",",","the","raw","credentials","data","may","or","may","not","be","encrypted","(","e.g",".","when","writing","to","disk",",","we","should","always","keep","it","encrypted",")",".","To","allow","Credentials","to","be","passed","from","Driver","to","Driver","without","excessive","calls","to","KMS.encrypt\/decrypt",",","this","``","data","''","in","the","Credentials","can","be","either","encrypted","or","not",".","It","is","up","to","the","code","that","constructs","the","Credentials","object","to","know","which",".","When","retrieving","the","raw",",","unencrypted","data","from","a","Credentials","object",",","use","the","following","code",":","if","credentials.is_encrypted","(",")",":","return","credentials.get_data_kms_decrypted","(",")","else",":","return","credentials.data","(",")"]
docstr: Encrypts the current Credentials.
  
  Calling this method will entirely change the internals of this Credentials object.
  Subsequent calls to .data() will return encrypted data.
docstr_tok: ["Encrypts","the","current","Credentials",".","Calling","this","method","will","entirely","change","the","internals","of","this","Credentials","object",".","Subsequent","calls","to",".data","(",")","will","return","encrypted","data","."]
code: def encrypt(self, region, kms_key_alias):
      """Encrypts the current Credentials.
  
      Calling this method will entirely change the internals of this Credentials object.
      Subsequent calls to .data() will return encrypted data.
      """
      if self.is_encrypted():
          return
  
      self._is_encrypted = True
      if not self._data:
          return
  
      creds_json = json.dumps(self._data, separators=(",", ":"))
      self._region = region
      self._data = AwsKms.encrypt(
          creds_json, region=self._region, key_alias=kms_key_alias
      )
  
imports: import json
  import os
  import shutil
  import tempfile
  from abc import abstractmethod
  from botocore.exceptions import ClientError
  from streamalert.shared.helpers.aws_api_client import AwsKms, AwsSsm
  from streamalert.shared.logger import get_logger
label_desc: Use image node_id 5 for calling the Credentials obj's underlying member method code with example usage: obj.encrypt(region, kms_key_alias) without return types