def _encrypt_entity(entity, key_encryption_key, encryption_resolver):
_validate_not_none('<STR_LIT>', entity)<EOL>_validate_not_none('<STR_LIT>', key_encryption_key)<EOL>_validate_key_encryption_key_wrap(key_encryption_key)<EOL>content_encryption_key = os.urandom(<NUM_LIT:32>)<EOL>entity_initialization_vector = os.urandom(<NUM_LIT:16>)<EOL>encrypted_properties = []<EOL>encrypted_entity = Entity()<EOL>for key, value in entity.items():<EOL><INDENT>if (isinstance(value, EntityProperty) and value.encrypt) or(encryption_resolver is not Noneand encryption_resolver(entity['<STR_LIT>'], entity['<STR_LIT>'], key)):<EOL><INDENT>if isinstance(value, EntityProperty):<EOL><INDENT>if value.type == EdmType.STRING:<EOL><INDENT>value = value.value<EOL><DEDENT>else:<EOL><INDENT>raise ValueError(_ERROR_UNSUPPORTED_TYPE_FOR_ENCRYPTION)<EOL><DEDENT><DEDENT>if not isinstance(value, str):<EOL><INDENT>raise ValueError(_ERROR_UNSUPPORTED_TYPE_FOR_ENCRYPTION)<EOL><DEDENT>encrypted_properties.append(key)<EOL>propertyIV = _generate_property_iv(entity_initialization_vector,<EOL>entity['<STR_LIT>'], entity['<STR_LIT>'],<EOL>key, False)<EOL>value = value.encode('<STR_LIT:utf-8>')<EOL>cipher = _generate_AES_CBC_cipher(content_encryption_key, propertyIV)<EOL>padder = PKCS7(<NUM_LIT>).padder()<EOL>padded_data = padder.update(value) + padder.finalize()<EOL>encryptor = cipher.encryptor()<EOL>encrypted_data = encryptor.update(padded_data) + encryptor.finalize()<EOL>value = EntityProperty(EdmType.BINARY, encrypted_data)<EOL><DEDENT>encrypted_entity[key] = value<EOL><DEDENT>encrypted_properties = dumps(encrypted_properties)<EOL>metadataIV = _generate_property_iv(entity_initialization_vector,<EOL>entity['<STR_LIT>'], entity['<STR_LIT>'],<EOL>'<STR_LIT>', False)<EOL>encrypted_properties = encrypted_properties.encode('<STR_LIT:utf-8>')<EOL>cipher = _generate_AES_CBC_cipher(content_encryption_key, metadataIV)<EOL>padder = PKCS7(<NUM_LIT>).padder()<EOL>padded_data = padder.update(encrypted_properties) + padder.finalize()<EOL>encryptor = cipher.encryptor()<EOL>encrypted_data = encryptor.update(padded_data) + encryptor.finalize()<EOL>encrypted_entity['<STR_LIT>'] = EntityProperty(EdmType.BINARY, encrypted_data)<EOL>encryption_data = _generate_encryption_data_dict(key_encryption_key, content_encryption_key,<EOL>entity_initialization_vector)<EOL>encrypted_entity['<STR_LIT>'] = dumps(encryption_data)<EOL>return encrypted_entity<EOL>
Encrypts the given entity using AES256 in CBC mode with 128 bit padding.
Will generate a content-encryption-key (cek) to encrypt the properties either
stored in an EntityProperty with the 'encrypt' flag set or those
specified by the encryption resolver. This cek is then wrapped using the 
provided key_encryption_key (kek). Only strings may be encrypted and the
result is stored as binary on the service. 

:param entity:
    The entity to insert. Could be a dict or an entity object.
:param object key_encryption_key:
    The user-provided key-encryption-key. Must implement the following methods:
    wrap_key(key)--wraps the specified key using an algorithm of the user's choice.
    get_key_wrap_algorithm()--returns the algorithm used to wrap the specified symmetric key.
    get_kid()--returns a string key id for this key-encryption-key.
:param function(partition_key, row_key, property_name) encryption_resolver:
    A function that takes in an entities partition key, row key, and property name and returns 
    a boolean that indicates whether that property should be encrypted.
:return: An entity with both the appropriate properties encrypted and the 
    encryption data.
:rtype: object