Documentation
¶
Overview ¶
Package kms provides an AWS KMS encryption provider for field-level encryption. It uses KMS for envelope encryption: GenerateDataKey creates DEKs via KMS, and Decrypt unwraps them. Field-level encryption uses the plaintext DEK locally.
Index ¶
- type KMSClient
- type KMSRevocationClient
- type Option
- type Provider
- func (p *Provider) Close() error
- func (p *Provider) Decrypt(ctx context.Context, keyID string, ciphertext []byte) ([]byte, error)
- func (p *Provider) DecryptDataKey(ctx context.Context, keyID string, encryptedKey []byte) ([]byte, error)
- func (p *Provider) Encrypt(ctx context.Context, keyID string, plaintext []byte) ([]byte, error)
- func (p *Provider) GenerateDataKey(ctx context.Context, keyID string) (*encryption.DataKey, error)
- func (p *Provider) IsRevoked(keyID string) (bool, error)
- func (p *Provider) RevokeKey(keyID string) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type KMSClient ¶
type KMSClient interface {
Encrypt(ctx context.Context, params *kms.EncryptInput, optFns ...func(*kms.Options)) (*kms.EncryptOutput, error)
Decrypt(ctx context.Context, params *kms.DecryptInput, optFns ...func(*kms.Options)) (*kms.DecryptOutput, error)
GenerateDataKey(ctx context.Context, params *kms.GenerateDataKeyInput, optFns ...func(*kms.Options)) (*kms.GenerateDataKeyOutput, error)
}
KMSClient defines the subset of the KMS API used by the provider.
type KMSRevocationClient ¶ added in v1.1.3
type KMSRevocationClient interface {
ScheduleKeyDeletion(ctx context.Context, params *kms.ScheduleKeyDeletionInput, optFns ...func(*kms.Options)) (*kms.ScheduleKeyDeletionOutput, error)
DescribeKey(ctx context.Context, params *kms.DescribeKeyInput, optFns ...func(*kms.Options)) (*kms.DescribeKeyOutput, error)
}
KMSRevocationClient is an OPTIONAL extension of KMSClient. When the injected client also implements it, the provider implements encryption.Revocable and supports crypto-shredding (GDPR erasure) by scheduling deletion of the customer master key (CMK). A CMK pending deletion is immediately unusable for decrypt, and AWS destroys the key material permanently after the pending window.
type Option ¶
type Option func(*Provider)
Option configures a KMS Provider.
func WithPendingDeletionWindow ¶ added in v1.1.3
WithPendingDeletionWindow sets the AWS KMS pending-deletion window in days used by RevokeKey. AWS only accepts 7–30 days, so an out-of-range value is clamped into that range — a misconfigured window cannot fail at RevokeKey time (the erasure moment). Defaults to 7 (the AWS minimum) when unset.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements encryption.Provider using AWS KMS.
func (*Provider) DecryptDataKey ¶
func (p *Provider) DecryptDataKey(ctx context.Context, keyID string, encryptedKey []byte) ([]byte, error)
DecryptDataKey decrypts an encrypted DEK using the KMS Decrypt API.
func (*Provider) GenerateDataKey ¶
GenerateDataKey creates a new DEK using KMS GenerateDataKey API. Returns a 256-bit (32-byte) AES key.
func (*Provider) IsRevoked ¶ added in v1.1.3
IsRevoked reports whether keyID's CMK is permanently unrecoverable — pending deletion, or already deleted (NotFound). A merely-disabled CMK is reversible via EnableKey, so it is NOT reported as revoked. It implements encryption.Revocable.
func (*Provider) RevokeKey ¶ added in v1.1.3
RevokeKey crypto-shreds keyID by scheduling deletion of its KMS CMK. It implements encryption.Revocable. It requires the injected client to implement KMSRevocationClient, otherwise it returns ErrRevocationUnsupported. It is idempotent: a CMK already pending deletion returns nil. A merely-disabled CMK is reversible (EnableKey), so it is NOT treated as already revoked — RevokeKey schedules its deletion so the crypto-shred is actually permanent.
Source Files