public class DirectKmsMaterialProvider extends java.lang.Object implements EncryptionMaterialsProvider
AWSKMS. Currently, the HashKey, RangeKey, and TableName will be included in the KMS
EncryptionContext for wrapping/unwrapping the key. This means that records cannot be copied/moved
between tables without re-encryption.| Constructor and Description |
|---|
DirectKmsMaterialProvider(com.amazonaws.services.kms.AWSKMS kms) |
DirectKmsMaterialProvider(com.amazonaws.services.kms.AWSKMS kms,
java.lang.String encryptionKeyId) |
DirectKmsMaterialProvider(com.amazonaws.services.kms.AWSKMS kms,
java.lang.String encryptionKeyId,
java.util.Map<java.lang.String,java.lang.String> materialDescription) |
| Modifier and Type | Method and Description |
|---|---|
protected com.amazonaws.services.kms.model.DecryptResult |
decrypt(com.amazonaws.services.kms.model.DecryptRequest request,
EncryptionContext context)
Decrypts ciphertext.
|
protected com.amazonaws.services.kms.model.GenerateDataKeyResult |
generateDataKey(com.amazonaws.services.kms.model.GenerateDataKeyRequest request,
EncryptionContext context)
Returns a data encryption key that you can use in your application to encrypt data locally.
|
DecryptionMaterials |
getDecryptionMaterials(EncryptionContext context)
Retrieves encryption materials matching the specified description from some source.
|
protected java.lang.String |
getEncryptionKeyId()
Get encryption key id that is used to create the
EncryptionMaterials. |
EncryptionMaterials |
getEncryptionMaterials(EncryptionContext context)
Returns EncryptionMaterials which the caller can use for encryption.
|
protected void |
populateKmsEcFromEc(EncryptionContext context,
java.util.Map<java.lang.String,java.lang.String> kmsEc)
Extracts relevant information from
context and uses it to populate fields in kmsEc. |
void |
refresh()
Forces this encryption materials provider to refresh its encryption material.
|
protected java.lang.String |
selectEncryptionKeyId(EncryptionContext context)
Select encryption key id to be used to generate data key.
|
protected void |
validateEncryptionKeyId(java.lang.String encryptionKeyId,
EncryptionContext context)
Validate the encryption key id.
|
public DirectKmsMaterialProvider(com.amazonaws.services.kms.AWSKMS kms)
public DirectKmsMaterialProvider(com.amazonaws.services.kms.AWSKMS kms,
java.lang.String encryptionKeyId,
java.util.Map<java.lang.String,java.lang.String> materialDescription)
public DirectKmsMaterialProvider(com.amazonaws.services.kms.AWSKMS kms,
java.lang.String encryptionKeyId)
public DecryptionMaterials getDecryptionMaterials(EncryptionContext context)
EncryptionMaterialsProvidergetDecryptionMaterials in interface EncryptionMaterialsProvidercontext - Information to assist in selecting a the proper return value. The implementation
is free to determine the minimum necessary for successful processing.public EncryptionMaterials getEncryptionMaterials(EncryptionContext context)
EncryptionMaterialsProvidergetEncryptionMaterials in interface EncryptionMaterialsProvidercontext - Information to assist in selecting a the proper return value. The implementation
is free to determine the minimum necessary for successful processing.protected java.lang.String getEncryptionKeyId()
EncryptionMaterials.protected java.lang.String selectEncryptionKeyId(EncryptionContext context) throws com.amazonaws.services.dynamodbv2.datamodeling.DynamoDBMappingException
encryptionKeyId.context - encryption context.com.amazonaws.services.dynamodbv2.datamodeling.DynamoDBMappingException - when we fails to select a valid encryption key id.protected void validateEncryptionKeyId(java.lang.String encryptionKeyId,
EncryptionContext context)
throws com.amazonaws.services.dynamodbv2.datamodeling.DynamoDBMappingException
encryptionKeyId - encryption key id from DecryptResult.context - encryption context.com.amazonaws.services.dynamodbv2.datamodeling.DynamoDBMappingException - when encryptionKeyId is invalid.protected com.amazonaws.services.kms.model.DecryptResult decrypt(com.amazonaws.services.kms.model.DecryptRequest request,
EncryptionContext context)
DecryptRequest. Subclass can override the default
implementation to provide additional request parameters using attributes within the EncryptionContext.request - request parameters to decrypt the given ciphertext.context - additional useful data to decrypt the ciphertext.protected com.amazonaws.services.kms.model.GenerateDataKeyResult generateDataKey(com.amazonaws.services.kms.model.GenerateDataKeyRequest request,
EncryptionContext context)
GenerateDataKeyRequest. Subclass can override the default implementation to provide
additional request parameters using attributes within the EncryptionContext.request - request parameters to generate the data key.context - additional useful data to generate the data key.protected void populateKmsEcFromEc(EncryptionContext context, java.util.Map<java.lang.String,java.lang.String> kmsEc)
context and uses it to populate fields in kmsEc. Subclass can override the default implementation to provide an alternative encryption
context in calls to KMS. Currently, the default implementation includes these fields:
HashKeyName
HashKeyValue
RangeKeyName
RangeKeyValue
TABLE_NAME_EC_KEY
TableName
public void refresh()
EncryptionMaterialsProviderrefresh in interface EncryptionMaterialsProvider