encryption

package

v0.0.0-...-dcff8da Latest Latest Go to latest Published: Apr 23, 2026 License: Apache-2.0 Imports: 9 Imported by: 18

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/aws/session-manager-plugin

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func KMSDecrypt(log log.T, svc KMSAPI, cipherTextBlob []byte, ...) (plainText []byte, err error)
func KMSGenerateDataKey(kmsKeyId string, svc KMSAPI, encryptionContext map[string]string) (cipherTextKey []byte, plainTextKey []byte, err error)
func NewKMSService(log log.T) (*kms.Client, error)
type Encrypter
type IEncrypter
type KMSAPI
type KMSKeyProvider

Constants ¶

View Source

const KMSKeySizeInBytes int32 = 64

KMSKeySizeInBytes is the key size that is fetched from KMS. 64 bytes key is split into two halves. First half 32 bytes key is used by agent for encryption and second half 32 bytes by clients like cli/console

Variables ¶

View Source

var NewEncrypter = func(log log.T, kmsKeyId string, context map[string]string, KMSService KMSAPI) (*Encrypter, error) {
	encrypter := Encrypter{kmsKeyId: kmsKeyId, KMSService: KMSService}
	err := encrypter.generateEncryptionKey(log, kmsKeyId, context)
	return &encrypter, err
}

Functions ¶

func KMSDecrypt ¶

func KMSDecrypt(log log.T, svc KMSAPI, cipherTextBlob []byte, encryptionContext map[string]string) (plainText []byte, err error)

func KMSGenerateDataKey ¶

func KMSGenerateDataKey(kmsKeyId string, svc KMSAPI, encryptionContext map[string]string) (cipherTextKey []byte, plainTextKey []byte, err error)

KMSGenerateDataKey gets cipher text and plain text keys from KMS service

func NewKMSService ¶

func NewKMSService(log log.T) (*kms.Client, error)

Types ¶

type Encrypter ¶

type Encrypter struct {
	KMSService KMSAPI
	// contains filtered or unexported fields
}

func (*Encrypter) Decrypt ¶

func (encrypter *Encrypter) Decrypt(log log.T, cipherText []byte) (plainText []byte, err error)

Decrypt decrypts a byte slice and returns the decrypted slice

func (*Encrypter) Encrypt ¶

func (encrypter *Encrypter) Encrypt(log log.T, plainText []byte) (cipherText []byte, err error)

Encrypt encrypts a byte slice and returns the encrypted slice

func (*Encrypter) GetEncryptedDataKey ¶

func (encrypter *Encrypter) GetEncryptedDataKey() (ciptherTextBlob []byte)

GetEncryptedDataKey returns the cipherText that was pulled from KMS

func (*Encrypter) GetKMSKeyId ¶

func (encrypter *Encrypter) GetKMSKeyId() (kmsKey string)

GetKMSKeyId gets the KMS key id that is used to generate the encryption key

type IEncrypter ¶

type IEncrypter interface {
	Encrypt(log log.T, plainText []byte) (cipherText []byte, err error)
	Decrypt(log log.T, cipherText []byte) (plainText []byte, err error)
	GetEncryptedDataKey() (ciptherTextBlob []byte)
}

type KMSAPI ¶

type KMSAPI interface {
	Decrypt(ctx context.Context, params *kms.DecryptInput, optFns ...func(*kms.Options)) (*kms.DecryptOutput, error)
	GenerateDataKey(ctx context.Context, params *kms.GenerateDataKeyInput, optFns ...func(*kms.Options)) (*kms.GenerateDataKeyOutput, error)
}

KMSAPI defines the interface for KMS operations This allows for easier testing and mocking

type KMSKeyProvider ¶

type KMSKeyProvider interface {
	GenerateDataKey()
}

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
mocks

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL