Documentation
¶
Overview ¶
Package kmsimport imports asymmetric RSA private key material into an AWS KMS key created with EXTERNAL origin, using the RSA_AES_KEY_WRAP_SHA_256 wrapping algorithm.
The package is a library first: Import takes a caller-supplied KMSClient and PKCS#8 DER key material, performs the GetParametersForImport / wrap / ImportKeyMaterial sequence, and returns a structured Result and an error. It never constructs an AWS SDK client and never calls os.Exit.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoClient = errors.New("kmsimport: no KMS client provided")
ErrNoClient is returned by Import when no KMSClient was provided.
var ErrNoKeyID = errors.New("kmsimport: no key identifier provided")
ErrNoKeyID is returned by Import when no key identifier was provided.
var ErrNoKeyMaterial = errors.New("kmsimport: no key material provided")
ErrNoKeyMaterial is returned by Import when no key material was provided.
Functions ¶
func KeyMaterialFromPEM ¶
KeyMaterialFromPEM decodes a PEM-encoded RSA private key and returns it as the PKCS#8 DER that Import (via WithKeyMaterial) expects. Decoding the operator's key file is part of pushing a key, so it lives in the library alongside the wrapping crypto rather than in any CLI wrapper.
The format is detected from the PEM block Type: GitHub issues App keys in PKCS#1 ("BEGIN RSA PRIVATE KEY"), which is converted to PKCS#8 DER; PKCS#8 ("BEGIN PRIVATE KEY") is accepted as-is. Any other header is rejected with an error naming the unsupported format.
Types ¶
type KMSClient ¶
type KMSClient interface {
GetParametersForImport(ctx context.Context, params *kms.GetParametersForImportInput, optFns ...func(*kms.Options)) (*kms.GetParametersForImportOutput, error)
ImportKeyMaterial(ctx context.Context, params *kms.ImportKeyMaterialInput, optFns ...func(*kms.Options)) (*kms.ImportKeyMaterialOutput, error)
}
KMSClient is the subset of the AWS KMS API that Import requires. The AWS SDK *kms.Client satisfies this interface directly. The library never constructs a client; the caller injects one.
type Option ¶
type Option func(*options)
Option configures an Import call.
func WithClient ¶
WithClient injects the KMS client used to perform the import.
func WithExpiry ¶
WithExpiry sets an expiry time for the imported key material. When provided, the import uses ExpirationModel KEY_MATERIAL_EXPIRES with ValidTo set to t. Absent this option the material does not expire.
func WithKeyID ¶
WithKeyID sets the target KMS key identifier, passed verbatim to the import APIs. KMS accepts a key ID or key ARN here (the import operations do not resolve aliases).
func WithKeyMaterial ¶
WithKeyMaterial sets the private key material to import, as PKCS#8 DER.
type Result ¶
type Result struct {
// KeyID is the KMS key identifier resolved by the import operation.
KeyID string
// KeyState is the key state following a successful import. It is always
// "Enabled": a successful ImportKeyMaterial transitions the key out of
// PendingImport, and the two-method KMSClient interface deliberately omits
// DescribeKey, so the state is inferred rather than queried.
KeyState string
}
Result describes the outcome of a successful import.
func Import ¶
Import imports key material into the target KMS key. It fetches the wrapping public key and import token via GetParametersForImport, encrypts the key material per RSA_AES_KEY_WRAP_SHA_256, and submits it with the matching import token via ImportKeyMaterial. By default the imported material does not expire.
Source Files