awskms

Documentation

Overview

Package awskms provides integration with the AWS Cloud KMS.

Index

• func NewClient(uriPrefix string) (registry.KMSClient, error)
• func NewClientWithCredentials(uriPrefix string, credentialPath string) (registry.KMSClient, error)
• func NewClientWithKMS(uriPrefix string, kms *kms.KMS) (registry.KMSClient, error)
• type AWSAEAD
  • func (a *AWSAEAD) Decrypt(ciphertext, additionalData []byte) ([]byte, error)
  • func (a *AWSAEAD) Encrypt(plaintext, additionalData []byte) ([]byte, error)

Functions

func NewClient

func NewClient(uriPrefix string) (registry.KMSClient, error)

NewClient returns a new AWS KMS client which will use default credentials to handle keys with uriPrefix prefix. uriPrefix must have the following format: 'aws-kms://arn:<partition>:kms:<region>:[:path]'. See http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html.

func NewClientWithCredentials

func NewClientWithCredentials(uriPrefix string, credentialPath string) (registry.KMSClient, error)

NewClientWithCredentials returns a new AWS KMS client which will use given credentials to handle keys with uriPrefix prefix. uriPrefix must have the following format: 'aws-kms://arn:<partition>:kms:<region>:[:path]'. See http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html.

func NewClientWithKMS

func NewClientWithKMS(uriPrefix string, kms *kms.KMS) (registry.KMSClient, error)

NewClientWithKMS returns a new AWS KMS client with user created KMS client. Client is responsible for keeping the region consistency between key URI and KMS client. uriPrefix must have the following format: 'aws-kms://arn:<partition>:kms:<region>:[:path]'. See http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html.

Types

type AWSAEAD

type AWSAEAD struct {
	// contains filtered or unexported fields
}

AWSAEAD represents a AWS KMS service to a particular URI.

func (*AWSAEAD) Decrypt

func (a *AWSAEAD) Decrypt(ciphertext, additionalData []byte) ([]byte, error)

Decrypt AEAD decrypts the data and verified the additional data.

func (*AWSAEAD) Encrypt

func (a *AWSAEAD) Encrypt(plaintext, additionalData []byte) ([]byte, error)

Encrypt AEAD encrypts the plaintext data and uses addtionaldata from authentication.