Documentation
¶
Overview ¶
Package kms is doze-aws's local Key Management Service with real crypto for all three key families:
- SYMMETRIC_DEFAULT keys encrypt/decrypt via AES-256-GCM with the encryption context bound as authenticated data; the ciphertext blob embeds the key id (like real KMS), so Decrypt needs no KeyId.
- RSA_2048/3072/4096 and ECC_NIST_P256/P384/P521 keys really sign/verify (RSASSA_PKCS1_V1_5, RSASSA_PSS, ECDSA) and RSA keys really encrypt/decrypt (RSAES_OAEP_SHA_1/SHA_256); GetPublicKey returns the genuine DER SPKI, so signatures verify outside KMS too.
- HMAC_224/256/384/512 keys really GenerateMac/VerifyMac.
Application crypto code works unmodified. ECC_SECG_P256K1 (secp256k1) is the one spec that answers UnsupportedOperationException — Go's standard library has no secp256k1, and doze-aws does not take crypto dependencies.
See docs/api-support/kms.md for the operation-by-operation support table.
Index ¶
- type Key
- type Options
- type Server
- type Store
- func (s *Store) Aliases() ([][2]string, error)
- func (s *Store) CreateKey(spec, usage, description, policy string, tags map[string]string) (*Key, error)
- func (s *Store) DeleteAlias(name string) error
- func (s *Store) List() ([]Key, error)
- func (s *Store) Resolve(ident string) (*Key, error)
- func (s *Store) SetAlias(name, keyIdent string, mustExist, mustNotExist bool) error
- func (s *Store) SweepDeletions()
- func (s *Store) Update(ident string, fn func(*Key) *awshttp.APIError) (*Key, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Key ¶
type Key struct {
ID string `json:"id"` // UUID
Material []byte `json:"material"`
OldMaterials [][]byte `json:"old_materials,omitempty"` // superseded backing keys, newest first, kept so pre-rotation ciphertexts still decrypt
Rotations []int64 `json:"rotations,omitempty"` // unix-seconds timestamps of each rotation, newest first
State string `json:"state"`
Description string `json:"description"`
Created int64 `json:"created"` // unix seconds
DeletionAt int64 `json:"deletion_at,omitempty"` // unix seconds, PendingDeletion only
RotationOn bool `json:"rotation_on"` // automatic-rotation flag
Policy string `json:"policy,omitempty"` // round-trip only
Tags map[string]string `json:"tags,omitempty"`
KeySpec string `json:"key_spec"` // SYMMETRIC_DEFAULT
KeyUsage string `json:"key_usage"` // ENCRYPT_DECRYPT
MultiRegion bool `json:"multi_region"`
}
Key is one customer master key.
type Options ¶
type Options struct {
// DataDir holds the bbolt store (kms.bolt). Required.
DataDir string
// Peers is accepted for constructor uniformity; KMS calls no siblings.
Peers peers.Directory
// Logf receives log lines; nil discards.
Logf func(format string, args ...any)
// Clock overrides time.Now in tests.
Clock func() time.Time
}
Options configures the service.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the KMS service: an http.Handler speaking AWS JSON 1.1, and an io.Closer that stops the janitor and closes the store.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is the bbolt-backed KMS state.
func (*Store) CreateKey ¶
func (s *Store) CreateKey(spec, usage, description, policy string, tags map[string]string) (*Key, error)
CreateKey mints a new key of the given spec. Material is the AES key (symmetric), the HMAC secret, or the PKCS#8 DER private key (RSA/ECC).
func (*Store) DeleteAlias ¶
DeleteAlias removes an alias.
func (*Store) Resolve ¶
Resolve maps any accepted key identifier — key id, key ARN, alias name, alias ARN — to the key.
func (*Store) SweepDeletions ¶
func (s *Store) SweepDeletions()
SweepDeletions finalizes PendingDeletion keys whose date has passed.
Source Files