class_docstr: Encapsulation for a set of credentials.
  
  When storing to or loading from a Driver, the raw credentials data may or may not be encrypted
  (e.g. when writing to disk, we should always keep it encrypted). To allow Credentials to be
  passed from Driver to Driver without excessive calls to KMS.encrypt/decrypt, this "data" in
  the Credentials can be either encrypted or not. It is up to the code that constructs the
  Credentials object to know which.
  
  When retrieving the raw, unencrypted data from a Credentials object, use the following code:
  
      if credentials.is_encrypted():
          return credentials.get_data_kms_decrypted()
      else:
          return credentials.data()
class_docstr_tok: ["Encapsulation","for","a","set","of","credentials",".","When","storing","to","or","loading","from","a","Driver",",","the","raw","credentials","data","may","or","may","not","be","encrypted","(","e.g",".","when","writing","to","disk",",","we","should","always","keep","it","encrypted",")",".","To","allow","Credentials","to","be","passed","from","Driver","to","Driver","without","excessive","calls","to","KMS.encrypt\/decrypt",",","this","``","data","''","in","the","Credentials","can","be","either","encrypted","or","not",".","It","is","up","to","the","code","that","constructs","the","Credentials","object","to","know","which",".","When","retrieving","the","raw",",","unencrypted","data","from","a","Credentials","object",",","use","the","following","code",":","if","credentials.is_encrypted","(",")",":","return","credentials.get_data_kms_decrypted","(",")","else",":","return","credentials.data","(",")"]
docstr: Args:
      data (object|string): A json serializable object, or a string.
      is_encrypted (bool): Pass True if the input data is encrypted with KMS. False otherwise.
      region (str): AWS Region. Only required if is_encrypted=True.
docstr_tok: ["Args",":","data","(","object|string",")",":","A","json","serializable","object",",","or","a","string",".","is_encrypted","(","bool",")",":","Pass","True","if","the","input","data","is","encrypted","with","KMS",".","False","otherwise",".","region","(","str",")",":","AWS","Region",".","Only","required","if","is_encrypted=True","."]
code: def __init__(self, data, is_encrypted=False, region=None):
      """
      Args:
          data (object|string): A json serializable object, or a string.
          is_encrypted (bool): Pass True if the input data is encrypted with KMS. False otherwise.
          region (str): AWS Region. Only required if is_encrypted=True.
      """
      self._data = data
      self._is_encrypted = is_encrypted
      self._region = region if is_encrypted else None
  
imports: import json
  import os
  import shutil
  import tempfile
  from abc import abstractmethod
  from botocore.exceptions import ClientError
  from streamalert.shared.helpers.aws_api_client import AwsKms, AwsSsm
  from streamalert.shared.logger import get_logger
label_desc: Use image node_id 1 to create a new Credentials object  with example: obj = Credentials(data, is_encrypted, region)