awskms

Documentation

Index

• Constants
• type Wrapper
  • func NewAWSKMSTestWrapper() *Wrapper
  • func NewWrapper(opts *wrapping.WrapperOptions) *Wrapper
  • func (k *Wrapper) Client() kmsiface.KMSAPI
  • func (k *Wrapper) Decrypt(_ context.Context, in *wrapping.EncryptedBlobInfo, aad []byte) (pt []byte, err error)
  • func (k *Wrapper) Encrypt(_ context.Context, plaintext, aad []byte) (blob *wrapping.EncryptedBlobInfo, err error)
  • func (k *Wrapper) Finalize(_ context.Context) error
  • func (k *Wrapper) GetAWSKMSClient() (*kms.KMS, error)
  • func (k *Wrapper) HMACKeyID() string
  • func (k *Wrapper) Init(_ context.Context) error
  • func (k *Wrapper) KeyID() string
  • func (k *Wrapper) SetConfig(config map[string]string) (map[string]string, error)
  • func (k *Wrapper) Type() string

Constants

const (
	EnvAWSKMSWrapperKeyID   = "AWSKMS_WRAPPER_KEY_ID"
	EnvVaultAWSKMSSealKeyID = "VAULT_AWSKMS_SEAL_KEY_ID"
)

These constants contain the accepted env vars; the Vault one is for backwards compat

const (
	// AWSKMSEncrypt is used to directly encrypt the data with KMS
	AWSKMSEncrypt = iota
	// AWSKMSEnvelopeAESGCMEncrypt is when a data encryption key is generated and
	// the data is encrypted with AESGCM and the key is encrypted with KMS
	AWSKMSEnvelopeAESGCMEncrypt
)

Types

type Wrapper

type Wrapper struct {
	// contains filtered or unexported fields
}

Wrapper represents credentials and Key information for the KMS Key used to encryption and decryption

func NewAWSKMSTestWrapper

func NewAWSKMSTestWrapper() *Wrapper

func NewWrapper

func NewWrapper(opts *wrapping.WrapperOptions) *Wrapper

NewWrapper creates a new AWSKMS wrapper with the provided options

func (*Wrapper) Client

func (k *Wrapper) Client() kmsiface.KMSAPI

Client returns the AWS KMS client used by the wrapper.

func (*Wrapper) Decrypt

func (k *Wrapper) Decrypt(_ context.Context, in *wrapping.EncryptedBlobInfo, aad []byte) (pt []byte, err error)

Decrypt is used to decrypt the ciphertext. This should be called after Init.

func (*Wrapper) Encrypt

func (k *Wrapper) Encrypt(_ context.Context, plaintext, aad []byte) (blob *wrapping.EncryptedBlobInfo, err error)

Encrypt is used to encrypt the master key using the the AWS CMK. This returns the ciphertext, and/or any errors from this call. This should be called after the KMS client has been instantiated.

func (*Wrapper) Finalize

func (k *Wrapper) Finalize(_ context.Context) error

Finalize is called during shutdown. This is a no-op since Wrapper doesn't require any cleanup.

func (*Wrapper) GetAWSKMSClient

func (k *Wrapper) GetAWSKMSClient() (*kms.KMS, error)

GetAWSKMSClient returns an instance of the KMS client.

func (*Wrapper) HMACKeyID

func (k *Wrapper) HMACKeyID() string

HMACKeyID returns the last known HMAC key id

func (*Wrapper) Init

func (k *Wrapper) Init(_ context.Context) error

Init is called during core.Initialize. No-op at the moment.

func (*Wrapper) KeyID

func (k *Wrapper) KeyID() string

KeyID returns the last known key id

func (*Wrapper) SetConfig

func (k *Wrapper) SetConfig(config map[string]string) (map[string]string, error)

SetConfig sets the fields on the Wrapper object based on values from the config parameter.

Order of precedence AWS values: * Environment variable * Passed in config map * Instance metadata role (access key and secret key) * Default values

func (*Wrapper) Type

func (k *Wrapper) Type() string

Type returns the wrapping type for this particular Wrapper implementation