Documentation
¶
Index ¶
- func EncryptUpdateExpressionValues(ctx context.Context, svc *Service, binding RecordBinding, ...) error
- func FailClosedIfEncryptedWithoutKMSKeyARN(sess *session.Session, metadata *model.Metadata) error
- func MetadataHasEncryptedFields(metadata *model.Metadata) bool
- type RecordBinding
- func BindingFromItem(table string, metadata *model.Metadata, item map[string]types.AttributeValue) (RecordBinding, bool)
- func NewRecordBinding(table string, partitionKey, sortKey types.AttributeValue) (RecordBinding, error)
- func NewRecordBindingFromKey(table string, metadata *model.Metadata, key map[string]types.AttributeValue) (RecordBinding, error)
- type Service
- func (s *Service) DecryptAttributeValue(ctx context.Context, attributeName string, envelope types.AttributeValue) (types.AttributeValue, error)
- func (s *Service) DecryptAttributeValueWithBinding(ctx context.Context, binding RecordBinding, attributeName string, ...) (types.AttributeValue, error)
- func (s *Service) EncryptAttributeValue(ctx context.Context, attributeName string, av types.AttributeValue) (types.AttributeValue, error)
- func (s *Service) EncryptAttributeValueWithBinding(ctx context.Context, binding RecordBinding, attributeName string, ...) (types.AttributeValue, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EncryptUpdateExpressionValues ¶
func EncryptUpdateExpressionValues( ctx context.Context, svc *Service, binding RecordBinding, metadata *model.Metadata, updateExpression string, exprAttrNames map[string]string, exprAttrValues map[string]types.AttributeValue, ) error
EncryptUpdateExpressionValues mutates exprAttrValues in-place by encrypting values assigned to encrypted fields. It currently supports direct SET assignments and if_not_exists() defaults for encrypted fields.
Types ¶
type RecordBinding ¶ added in v6.1.0
type RecordBinding struct {
PartitionKey types.AttributeValue
SortKey types.AttributeValue
Table string
}
RecordBinding identifies the stored row an encrypted envelope belongs to. Envelope v2 authenticates this binding in the AES-GCM additional data, so a valid envelope copied onto another record or another table fails to decrypt.
func BindingFromItem ¶ added in v6.1.0
func BindingFromItem(table string, metadata *model.Metadata, item map[string]types.AttributeValue) (RecordBinding, bool)
BindingFromItem derives a record binding from a full or projected item. It reports false when the item does not carry the key attributes, which is the case for a projection that omits them.
func NewRecordBinding ¶ added in v6.1.0
func NewRecordBinding(table string, partitionKey, sortKey types.AttributeValue) (RecordBinding, error)
NewRecordBinding validates and returns a record binding.
func NewRecordBindingFromKey ¶ added in v6.1.0
func NewRecordBindingFromKey(table string, metadata *model.Metadata, key map[string]types.AttributeValue) (RecordBinding, error)
NewRecordBindingFromKey builds a binding from a model key map. metadata and the key map must describe the same row; a missing partition key is an error so a write cannot silently produce an unbound envelope.
func (RecordBinding) Valid ¶ added in v6.1.0
func (b RecordBinding) Valid() bool
Valid reports whether the binding carries the minimum identity needed to construct the v2 additional authenticated data.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service implements envelope encryption for DynamoDB attribute values using AWS KMS.
func NewService ¶
func NewServiceWithRand ¶
func (*Service) DecryptAttributeValue ¶
func (s *Service) DecryptAttributeValue(ctx context.Context, attributeName string, envelope types.AttributeValue) (types.AttributeValue, error)
DecryptAttributeValue decrypts a legacy v1 envelope. A v2 envelope requires the record binding and is rejected here rather than decrypted without it.
func (*Service) DecryptAttributeValueWithBinding ¶ added in v6.1.0
func (s *Service) DecryptAttributeValueWithBinding(ctx context.Context, binding RecordBinding, attributeName string, envelope types.AttributeValue) (types.AttributeValue, error)
DecryptAttributeValueWithBinding decrypts v2 envelopes with their record binding and still accepts legacy v1 envelopes for read compatibility.
func (*Service) EncryptAttributeValue ¶
func (s *Service) EncryptAttributeValue(ctx context.Context, attributeName string, av types.AttributeValue) (types.AttributeValue, error)
EncryptAttributeValue writes a legacy v1 envelope that authenticates only the attribute name. New writes to stored records should use EncryptAttributeValueWithBinding so an envelope cannot be replayed onto another record or table.
func (*Service) EncryptAttributeValueWithBinding ¶ added in v6.1.0
func (s *Service) EncryptAttributeValueWithBinding(ctx context.Context, binding RecordBinding, attributeName string, av types.AttributeValue) (types.AttributeValue, error)
EncryptAttributeValueWithBinding writes a v2 envelope bound to the record identity (table, partition key, sort key) in addition to the attribute name. The same binding is also supplied to KMS as the data key's EncryptionContext.
Source Files