Documentation
¶
Overview ¶
Package kms provides emulation of AWS Key Management Service (KMS). See docs/services/kms.md for the support matrix.
Wire protocol: JSON (X-Amz-Target: TrentService.*) Symmetric keys use AES-256-GCM for Encrypt/Decrypt. RSA_2048 SIGN_VERIFY keys use RSASSA_PKCS1_V1_5_SHA_256.
Index ¶
- type Alias
- type Grant
- type GrantConstraint
- type Handler
- func (h *Handler) CancelKeyDeletion(w http.ResponseWriter, r *http.Request)
- func (h *Handler) CreateAlias(w http.ResponseWriter, r *http.Request)
- func (h *Handler) CreateGrant(w http.ResponseWriter, r *http.Request)
- func (h *Handler) CreateKey(w http.ResponseWriter, r *http.Request)
- func (h *Handler) Decrypt(w http.ResponseWriter, r *http.Request)
- func (h *Handler) DeleteAlias(w http.ResponseWriter, r *http.Request)
- func (h *Handler) DescribeKey(w http.ResponseWriter, r *http.Request)
- func (h *Handler) DisableKey(w http.ResponseWriter, r *http.Request)
- func (h *Handler) EnableKey(w http.ResponseWriter, r *http.Request)
- func (h *Handler) Encrypt(w http.ResponseWriter, r *http.Request)
- func (h *Handler) GenerateDataKey(w http.ResponseWriter, r *http.Request)
- func (h *Handler) GenerateDataKeyPair(w http.ResponseWriter, r *http.Request)
- func (h *Handler) GenerateDataKeyWithoutPlaintext(w http.ResponseWriter, r *http.Request)
- func (h *Handler) GetKeyPolicy(w http.ResponseWriter, r *http.Request)
- func (h *Handler) GetPublicKey(w http.ResponseWriter, r *http.Request)
- func (h *Handler) ListAliases(w http.ResponseWriter, r *http.Request)
- func (h *Handler) ListGrants(w http.ResponseWriter, r *http.Request)
- func (h *Handler) ListKeyPolicies(w http.ResponseWriter, r *http.Request)
- func (h *Handler) ListKeys(w http.ResponseWriter, r *http.Request)
- func (h *Handler) ListResourceTags(w http.ResponseWriter, r *http.Request)
- func (h *Handler) ListRetirableGrants(w http.ResponseWriter, r *http.Request)
- func (h *Handler) PutKeyPolicy(w http.ResponseWriter, r *http.Request)
- func (h *Handler) ReEncrypt(w http.ResponseWriter, r *http.Request)
- func (h *Handler) RetireGrant(w http.ResponseWriter, r *http.Request)
- func (h *Handler) RevokeGrant(w http.ResponseWriter, r *http.Request)
- func (h *Handler) ScheduleKeyDeletion(w http.ResponseWriter, r *http.Request)
- func (h *Handler) Sign(w http.ResponseWriter, r *http.Request)
- func (h *Handler) TagResource(w http.ResponseWriter, r *http.Request)
- func (h *Handler) UntagResource(w http.ResponseWriter, r *http.Request)
- func (h *Handler) UpdateAlias(w http.ResponseWriter, r *http.Request)
- func (h *Handler) Verify(w http.ResponseWriter, r *http.Request)
- func (h *Handler) VerifyMac(w http.ResponseWriter, r *http.Request)
- type Key
- type Service
- func (s *Service) Dispatch(w http.ResponseWriter, r *http.Request)
- func (s *Service) InitBus(bus *events.Bus)
- func (s *Service) Name() string
- func (s *Service) Operations() []op.Operation
- func (s *Service) RegisterRoutes(_ chi.Router)
- func (s *Service) SupportedProtocols() []codec.Codec
- func (s *Service) TargetPrefix() string
- type Store
- func (st *Store) DeleteAlias(ctx context.Context, aliasName string) error
- func (st *Store) DeleteGrant(ctx context.Context, grantID string) error
- func (st *Store) GetAlias(ctx context.Context, aliasName string) (*Alias, error)
- func (st *Store) GetGrant(ctx context.Context, grantID string) (*Grant, error)
- func (st *Store) GetKey(ctx context.Context, keyID string) (*Key, error)
- func (st *Store) PutAlias(ctx context.Context, a *Alias) error
- func (st *Store) PutGrant(ctx context.Context, g *Grant) error
- func (st *Store) PutKey(ctx context.Context, k *Key) error
- func (st *Store) ScanAliases(ctx context.Context, keyID string) ([]*Alias, error)
- func (st *Store) ScanAllGrants(ctx context.Context) ([]*Grant, error)
- func (st *Store) ScanGrantsByKey(ctx context.Context, keyID string) ([]*Grant, error)
- func (st *Store) ScanGrantsByPrincipal(ctx context.Context, principal string) ([]*Grant, error)
- func (st *Store) ScanKeys(ctx context.Context) ([]*Key, error)
- type Tag
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Alias ¶
type Alias struct {
AliasName string `json:"AliasName"`
AliasARN string `json:"AliasARN"`
TargetKeyID string `json:"TargetKeyID"`
CreatedAt time.Time `json:"CreatedAt"`
}
Alias represents a KMS alias.
type Grant ¶
type Grant struct {
GrantID string `json:"GrantID"`
GrantToken string `json:"GrantToken"`
KeyID string `json:"KeyID"`
GranteePrincipal string `json:"GranteePrincipal"`
RetiringPrincipal string `json:"RetiringPrincipal,omitempty"`
Operations []string `json:"Operations"`
Constraints *GrantConstraint `json:"Constraints,omitempty"`
Name string `json:"Name,omitempty"`
CreationDate time.Time `json:"CreationDate"`
ExpirationDate *time.Time `json:"ExpirationDate,omitempty"`
}
Grant represents a KMS grant.
type GrantConstraint ¶
type GrantConstraint struct {
EncryptionContextSubset map[string]string `json:"EncryptionContextSubset,omitempty"`
EncryptionContextEquals map[string]string `json:"EncryptionContextEquals,omitempty"`
}
GrantConstraint represents a constraint on a KMS grant.
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler holds KMS handler dependencies.
func (*Handler) CancelKeyDeletion ¶
func (h *Handler) CancelKeyDeletion(w http.ResponseWriter, r *http.Request)
CancelKeyDeletion cancels pending deletion.
func (*Handler) CreateAlias ¶
func (h *Handler) CreateAlias(w http.ResponseWriter, r *http.Request)
CreateAlias creates an alias pointing to a key.
func (*Handler) CreateGrant ¶
func (h *Handler) CreateGrant(w http.ResponseWriter, r *http.Request)
CreateGrant creates a grant for a KMS key.
func (*Handler) CreateKey ¶
func (h *Handler) CreateKey(w http.ResponseWriter, r *http.Request)
CreateKey creates a new KMS key with optional crypto material.
func (*Handler) Decrypt ¶
func (h *Handler) Decrypt(w http.ResponseWriter, r *http.Request)
Decrypt decrypts a ciphertext blob.
func (*Handler) DeleteAlias ¶
func (h *Handler) DeleteAlias(w http.ResponseWriter, r *http.Request)
DeleteAlias removes an alias.
func (*Handler) DescribeKey ¶
func (h *Handler) DescribeKey(w http.ResponseWriter, r *http.Request)
DescribeKey returns key metadata.
func (*Handler) DisableKey ¶
func (h *Handler) DisableKey(w http.ResponseWriter, r *http.Request)
DisableKey disables a key.
func (*Handler) EnableKey ¶
func (h *Handler) EnableKey(w http.ResponseWriter, r *http.Request)
EnableKey enables a key.
func (*Handler) Encrypt ¶
func (h *Handler) Encrypt(w http.ResponseWriter, r *http.Request)
Encrypt encrypts plaintext using a symmetric key.
func (*Handler) GenerateDataKey ¶
func (h *Handler) GenerateDataKey(w http.ResponseWriter, r *http.Request)
GenerateDataKey returns a new random data key, both plaintext and encrypted.
func (*Handler) GenerateDataKeyPair ¶
func (h *Handler) GenerateDataKeyPair(w http.ResponseWriter, r *http.Request)
GenerateDataKeyPair returns an encrypted private key and plaintext public key.
func (*Handler) GenerateDataKeyWithoutPlaintext ¶
func (h *Handler) GenerateDataKeyWithoutPlaintext(w http.ResponseWriter, r *http.Request)
GenerateDataKeyWithoutPlaintext returns an encrypted data key only.
func (*Handler) GetKeyPolicy ¶
func (h *Handler) GetKeyPolicy(w http.ResponseWriter, r *http.Request)
GetKeyPolicy returns the key policy for a KMS key.
func (*Handler) GetPublicKey ¶
func (h *Handler) GetPublicKey(w http.ResponseWriter, r *http.Request)
GetPublicKey returns the public key for an asymmetric KMS key.
func (*Handler) ListAliases ¶
func (h *Handler) ListAliases(w http.ResponseWriter, r *http.Request)
ListAliases returns all aliases, optionally filtered by key ID.
func (*Handler) ListGrants ¶
func (h *Handler) ListGrants(w http.ResponseWriter, r *http.Request)
ListGrants lists grants for a KMS key.
func (*Handler) ListKeyPolicies ¶
func (h *Handler) ListKeyPolicies(w http.ResponseWriter, r *http.Request)
ListKeyPolicies lists the policy names for a KMS key.
func (*Handler) ListKeys ¶
func (h *Handler) ListKeys(w http.ResponseWriter, r *http.Request)
ListKeys returns all key IDs and ARNs.
func (*Handler) ListResourceTags ¶
func (h *Handler) ListResourceTags(w http.ResponseWriter, r *http.Request)
ListResourceTags lists tags on a KMS key. AWS docs: https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html
func (*Handler) ListRetirableGrants ¶
func (h *Handler) ListRetirableGrants(w http.ResponseWriter, r *http.Request)
ListRetirableGrants lists grants that the specified principal can retire.
func (*Handler) PutKeyPolicy ¶
func (h *Handler) PutKeyPolicy(w http.ResponseWriter, r *http.Request)
PutKeyPolicy attaches a key policy to a KMS key.
func (*Handler) ReEncrypt ¶
func (h *Handler) ReEncrypt(w http.ResponseWriter, r *http.Request)
ReEncrypt decrypts ciphertext from one key and re-encrypts with another.
func (*Handler) RetireGrant ¶
func (h *Handler) RetireGrant(w http.ResponseWriter, r *http.Request)
RetireGrant retires a grant. The grantId must match the retiring principal.
func (*Handler) RevokeGrant ¶
func (h *Handler) RevokeGrant(w http.ResponseWriter, r *http.Request)
RevokeGrant revokes a grant from a KMS key.
func (*Handler) ScheduleKeyDeletion ¶
func (h *Handler) ScheduleKeyDeletion(w http.ResponseWriter, r *http.Request)
ScheduleKeyDeletion marks a key as pending deletion.
func (*Handler) Sign ¶
func (h *Handler) Sign(w http.ResponseWriter, r *http.Request)
Sign signs a message using an asymmetric key.
func (*Handler) TagResource ¶
func (h *Handler) TagResource(w http.ResponseWriter, r *http.Request)
TagResource adds or overwrites tags on a KMS key. AWS docs: https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html
func (*Handler) UntagResource ¶
func (h *Handler) UntagResource(w http.ResponseWriter, r *http.Request)
UntagResource removes tags from a KMS key by key names. AWS docs: https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html
func (*Handler) UpdateAlias ¶
func (h *Handler) UpdateAlias(w http.ResponseWriter, r *http.Request)
UpdateAlias updates an alias to point to a different key.
type Key ¶
type Key struct {
KeyID string `json:"KeyID"`
ARN string `json:"ARN"`
Description string `json:"Description"`
KeySpec string `json:"KeySpec"` // "SYMMETRIC_DEFAULT", "RSA_2048", etc.
KeyUsage string `json:"KeyUsage"` // "ENCRYPT_DECRYPT", "SIGN_VERIFY"
Enabled bool `json:"Enabled"`
KeyState string `json:"KeyState"` // "Enabled", "Disabled", "PendingDeletion"
DeletionDate *time.Time `json:"DeletionDate,omitempty"`
CreatedAt time.Time `json:"CreatedAt"`
Tags []Tag `json:"Tags,omitempty"`
Policy string `json:"Policy,omitempty"` // JSON key policy document
// Crypto material (never sent to clients)
AESKey []byte `json:"AESKey,omitempty"` // 32 bytes for SYMMETRIC_DEFAULT
RSAPrivKey []byte `json:"RSAPrivKey,omitempty"` // PEM-encoded private key for RSA
}
Key represents a KMS key.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service implements router.Service and router.TargetDispatcher for KMS.
func (*Service) Dispatch ¶
func (s *Service) Dispatch(w http.ResponseWriter, r *http.Request)
Dispatch satisfies router.TargetDispatcher.
func (*Service) Operations ¶
Operations implements router.ProtocolService.
func (*Service) RegisterRoutes ¶
RegisterRoutes satisfies router.Service. KMS has no path-routed endpoints.
func (*Service) SupportedProtocols ¶
SupportedProtocols implements router.ProtocolService.
func (*Service) TargetPrefix ¶
TargetPrefix satisfies router.TargetDispatcher.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store wraps state.Store with KMS-specific helpers.
func (*Store) DeleteAlias ¶
DeleteAlias removes an alias.
func (*Store) DeleteGrant ¶
DeleteGrant removes a grant.
func (*Store) ScanAliases ¶
ScanAliases returns all aliases, optionally filtered to a single keyID. If keyID is empty, all aliases are returned.
func (*Store) ScanAllGrants ¶
ScanAllGrants returns every grant in the store.
func (*Store) ScanGrantsByKey ¶
ScanGrantsByKey returns all grants for a given key ID.
func (*Store) ScanGrantsByPrincipal ¶
ScanGrantsByPrincipal returns all grants for a given principal.
Source Files