Struct EncryptedPart

#[non_exhaustive]
pub struct EncryptedPart {
    pub name: Option<String>,
    pub prefix: Option<String>,
}

A part of a Compound Beacon that contains a beacon over encrypted data.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

name: Option<String>

The name of the Standard Beacon, whose value this Part will hold.

prefix: Option<String>

The prefix that is written with this Encrypted Part.

Implementations

impl EncryptedPart

pub fn name(&self) -> &Option<String>

The name of the Standard Beacon, whose value this Part will hold.

pub fn prefix(&self) -> &Option<String>

The prefix that is written with this Encrypted Part.

impl EncryptedPart

pub fn builder() -> EncryptedPartBuilder

Creates a new builder-style object to manufacture EncryptedPart.

Examples found in repository

examples/searchableencryption/compound_beacon_searchable_encryption.rs (line 99)

pub async fn put_and_query_with_beacon(branch_key_id: &str) -> Result<(), crate::BoxError> {
    let ddb_table_name = test_utils::UNIT_INSPECTION_TEST_DDB_TABLE_NAME;
    let branch_key_wrapping_kms_key_arn = test_utils::TEST_BRANCH_KEY_WRAPPING_KMS_KEY_ARN;
    let branch_key_ddb_table_name = test_utils::TEST_BRANCH_KEYSTORE_DDB_TABLE_NAME;

    // 1. Create Beacons.
    //    These are the same beacons as in the "BasicSearchableEncryptionExample" in this directory.
    //    See that file to see details on beacon construction and parameters.
    //    While we will not directly query against these beacons,
    //      you must create standard beacons on encrypted fields
    //      that we wish to use in compound beacons.
    let last4_beacon = StandardBeacon::builder()
        .name("inspector_id_last4")
        .length(10)
        .build()?;

    let unit_beacon = StandardBeacon::builder().name("unit").length(30).build()?;

    let standard_beacon_list = vec![last4_beacon, unit_beacon];

    // 2. Define encrypted parts.
    //    Encrypted parts define the beacons that can be used to construct a compound beacon,
    //        and how the compound beacon prefixes those beacon values.

    // A encrypted part must receive:
    //  - name: Name of a standard beacon
    //  - prefix: Any string. This is plaintext that prefixes the beaconized value in the compound beacon.
    //            Prefixes must be unique across the configuration, and must not be a prefix of another prefix;
    //            i.e. for all configured prefixes, the first N characters of a prefix must not equal another prefix.
    // In practice, it is suggested to have a short value distinguishable from other parts served on the prefix.
    // For this example, we will choose "L-" as the prefix for "Last 4 digits of inspector ID".
    // With this prefix and the standard beacon's bit length definition (10), the beaconized
    //     version of the inspector ID's last 4 digits will appear as
    //     `L-000` to `L-3ff` inside a compound beacon.

    // For this example, we will choose "U-" as the prefix for "unit".
    // With this prefix and the standard beacon's bit length definition (30), a unit beacon will appear
    //     as `U-00000000` to `U-3fffffff` inside a compound beacon.
    let encrypted_parts_list = vec![
        EncryptedPart::builder()
            .name("inspector_id_last4")
            .prefix("L-")
            .build()?,
        EncryptedPart::builder().name("unit").prefix("U-").build()?,
    ];

    // 3. Define compound beacon.
    //    A compound beacon allows one to serve multiple beacons or attributes from a single index.
    //    A compound beacon must receive:
    //     - name: The name of the beacon. Compound beacon values will be written to `aws_ddb_e_[name]`.
    //     - split: A character separating parts in a compound beacon
    //    A compound beacon may also receive:
    //     - encrypted: A list of encrypted parts. This is effectively a list of beacons. We provide the list
    //                  that we created above.
    //     - constructors: A list of constructors. This is an ordered list of possible ways to create a beacon.
    //                     We have not defined any constructors here; see the complex example for how to do this.
    //                     The client will provide a default constructor, which will write a compound beacon as:
    //                     all signed parts in the order they are added to the signed list;
    //                     all encrypted parts in order they are added to the encrypted list; all parts required.
    //                     In this example, we expect compound beacons to be written as
    //                     `L-XXX.U-YYYYYYYY`, since our encrypted list looks like
    //                     [last4EncryptedPart, unitEncryptedPart].
    //     - signed: A list of signed parts, i.e. plaintext attributes. This would be provided if we
    //                     wanted to use plaintext values as part of constructing our compound beacon. We do not
    //                     provide this here; see the Complex example for an example.
    let compound_beacon_list = vec![CompoundBeacon::builder()
        .name("last4UnitCompound")
        .split(".")
        .encrypted(encrypted_parts_list)
        .build()?];

    // 4. Configure the Keystore
    //    These are the same constructions as in the Basic example, which describes these in more detail.

    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let key_store_config = KeyStoreConfig::builder()
        .kms_client(aws_sdk_kms::Client::new(&sdk_config))
        .ddb_client(aws_sdk_dynamodb::Client::new(&sdk_config))
        .ddb_table_name(branch_key_ddb_table_name)
        .logical_key_store_name(branch_key_ddb_table_name)
        .kms_configuration(KmsConfiguration::KmsKeyArn(
            branch_key_wrapping_kms_key_arn.to_string(),
        ))
        .build()?;

    let key_store = keystore_client::Client::from_conf(key_store_config)?;

    // 5. Create BeaconVersion.
    //    This is similar to the Basic example, except we have also provided a compoundBeaconList.
    //    We must also continue to provide all of the standard beacons that compose a compound beacon list.
    let beacon_version = BeaconVersion::builder()
        .standard_beacons(standard_beacon_list)
        .compound_beacons(compound_beacon_list)
        .version(1) // MUST be 1
        .key_store(key_store.clone())
        .key_source(BeaconKeySource::Single(
            SingleKeyStore::builder()
                // `keyId` references a beacon key.
                // For every branch key we create in the keystore,
                // we also create a beacon key.
                // This beacon key is not the same as the branch key,
                // but is created with the same ID as the branch key.
                .key_id(branch_key_id)
                .cache_ttl(6000)
                .build()?,
        ))
        .build()?;
    let beacon_versions = vec![beacon_version];

    // 6. Create a Hierarchical Keyring
    //    This is the same configuration as in the Basic example.

    let mpl_config = MaterialProvidersConfig::builder().build()?;
    let mpl = mpl_client::Client::from_conf(mpl_config)?;
    let kms_keyring = mpl
        .create_aws_kms_hierarchical_keyring()
        .branch_key_id(branch_key_id)
        .key_store(key_store)
        .ttl_seconds(6000)
        .send()
        .await?;

    // 7. Configure which attributes are encrypted and/or signed when writing new items.
    let attribute_actions_on_encrypt = HashMap::from([
        ("work_id".to_string(), CryptoAction::SignOnly), // Our partition attribute must be SIGN_ONLY
        ("inspection_date".to_string(), CryptoAction::SignOnly), // Our sort attribute must be SIGN_ONLY
        (
            "inspector_id_last4".to_string(),
            CryptoAction::EncryptAndSign,
        ), // Beaconized attributes must be encrypted
        ("unit".to_string(), CryptoAction::EncryptAndSign), // Beaconized attributes must be encrypted
    ]);

    // We do not need to define a crypto action on last4UnitCompound.
    // We only need to define crypto actions on attributes that we pass to PutItem.

    // 8. Create the DynamoDb Encryption configuration for the table we will be writing to.
    //    The beaconVersions are added to the search configuration.
    let table_config = DynamoDbTableEncryptionConfig::builder()
        .logical_table_name(ddb_table_name)
        .partition_key_name("work_id")
        .sort_key_name("inspection_date")
        .attribute_actions_on_encrypt(attribute_actions_on_encrypt)
        .keyring(kms_keyring)
        .search(
            SearchConfig::builder()
                .write_version(1) // MUST be 1
                .versions(beacon_versions)
                .build()?,
        )
        .build()?;

    // 9. Create config
    let encryption_config = DynamoDbTablesEncryptionConfig::builder()
        .table_encryption_configs(HashMap::from([(ddb_table_name.to_string(), table_config)]))
        .build()?;

    // 10. Create an item with both attributes used in the compound beacon.
    let item = HashMap::from([
        (
            "work_id".to_string(),
            AttributeValue::S("9ce39272-8068-4efd-a211-cd162ad65d4c".to_string()),
        ),
        (
            "inspection_date".to_string(),
            AttributeValue::S("2023-06-13".to_string()),
        ),
        (
            "inspector_id_last4".to_string(),
            AttributeValue::S("5678".to_string()),
        ),
        (
            "unit".to_string(),
            AttributeValue::S("011899988199".to_string()),
        ),
    ]);

    // 11. If developing or debugging, verify config by checking compound beacon values directly
    let trans = transform_client::Client::from_conf(encryption_config.clone())?;
    let resolve_output = trans
        .resolve_attributes()
        .table_name(ddb_table_name)
        .item(item.clone())
        .version(1)
        .send()
        .await?;

    // Verify that there are no virtual fields
    assert_eq!(resolve_output.virtual_fields.unwrap().len(), 0);

    // Verify that CompoundBeacons has the expected value
    let compound_beacons = resolve_output.compound_beacons.unwrap();
    assert_eq!(compound_beacons.len(), 1);
    assert_eq!(
        compound_beacons["last4UnitCompound"],
        "L-5678.U-011899988199"
    );
    // Note : the compound beacon actually stored in the table is not "L-5678.U-011899988199"
    // but rather something like "L-abc.U-123", as both parts are EncryptedParts
    // and therefore the text is replaced by the associated beacon

    // 12. Create a new AWS SDK DynamoDb client using the DynamoDb Encryption Interceptor above
    let dynamo_config = aws_sdk_dynamodb::config::Builder::from(&sdk_config)
        .interceptor(DbEsdkInterceptor::new(encryption_config)?)
        .build();
    let ddb = aws_sdk_dynamodb::Client::from_conf(dynamo_config);

    // 13. Write the item to the table
    ddb.put_item()
        .table_name(ddb_table_name)
        .set_item(Some(item.clone()))
        .send()
        .await?;

    // 14. Query for the item we just put.
    let expression_attribute_values = HashMap::from([
        // This query expression takes a few factors into consideration:
        //  - The configured prefix for the last 4 digits of an inspector ID is "L-";
        //    the prefix for the unit is "U-"
        //  - The configured split character, separating component parts, is "."
        //  - The default constructor adds encrypted parts in the order they are in the encrypted list, which
        //    configures `last4` to come before `unit``
        // NOTE: We did not need to create a compound beacon for this query. This query could have also been
        //       done by querying on the partition and sort key, as was done in the Basic example.
        //       This is intended to be a simple example to demonstrate how one might set up a compound beacon.
        //       For examples where compound beacons are required, see the Complex example.
        //       The most basic extension to this example that would require a compound beacon would add a third
        //       part to the compound beacon, then query against three parts.
        (
            ":value".to_string(),
            AttributeValue::S("L-5678.U-011899988199".to_string()),
        ),
    ]);

    // GSIs are sometimes a little bit delayed, so we retry if the query comes up empty.
    for _i in 0..10 {
        let query_response = ddb
            .query()
            .table_name(ddb_table_name)
            .index_name(GSI_NAME)
            .key_condition_expression("last4UnitCompound = :value")
            .set_expression_attribute_values(Some(expression_attribute_values.clone()))
            .send()
            .await?;

        // if no results, sleep and try again
        if query_response.items.is_none() || query_response.items.as_ref().unwrap().is_empty() {
            std::thread::sleep(std::time::Duration::from_millis(20));
            continue;
        }

        let attribute_values = query_response.items.unwrap();
        // Validate only 1 item was returned: the item we just put
        assert_eq!(attribute_values.len(), 1);
        let returned_item = &attribute_values[0];
        // Validate the item has the expected attributes
        assert_eq!(
            returned_item["inspector_id_last4"],
            AttributeValue::S("5678".to_string())
        );
        assert_eq!(
            returned_item["unit"],
            AttributeValue::S("011899988199".to_string())
        );
        break;
    }
    println!("compound_beacon_searchable_encryption successful.");
    Ok(())
}

examples/searchableencryption/beacon_styles_searchable_encryption.rs (line 110)

pub async fn put_and_query_with_beacon(branch_key_id: &str) -> Result<(), crate::BoxError> {
    let ddb_table_name = test_utils::UNIT_INSPECTION_TEST_DDB_TABLE_NAME;
    let branch_key_wrapping_kms_key_arn = test_utils::TEST_BRANCH_KEY_WRAPPING_KMS_KEY_ARN;
    let branch_key_ddb_table_name = test_utils::TEST_BRANCH_KEYSTORE_DDB_TABLE_NAME;

    // 1. Create Beacons.
    let standard_beacon_list = vec![
        // The fruit beacon allows searching on the encrypted fruit attribute
        // We have selected 30 as an example beacon length, but you should go to
        // https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/choosing-beacon-length.html
        // when creating your beacons.
        StandardBeacon::builder().name("fruit").length(30).build()?,
        // The basket beacon allows searching on the encrypted basket attribute
        // Basket is used as a Set, and therefore needs a beacon style to reflect that.
        // Further, we need to be able to compare the items in basket to the fruit attribute
        // so we `share` this beacon with `fruit`.
        // Since we need both of these things, we use the SharedSet style.
        StandardBeacon::builder()
            .name("basket")
            .length(30)
            .style(BeaconStyle::SharedSet(
                SharedSet::builder().other("fruit").build()?,
            ))
            .build()?,
        // The dessert beacon allows searching on the encrypted dessert attribute
        // We need to be able to compare the dessert attribute to the fruit attribute
        // so we `share` this beacon with `fruit`.
        StandardBeacon::builder()
            .name("dessert")
            .length(30)
            .style(BeaconStyle::Shared(
                Shared::builder().other("fruit").build()?,
            ))
            .build()?,
        // The veggieBeacon allows searching on the encrypted veggies attribute
        // veggies is used as a Set, and therefore needs a beacon style to reflect that.
        StandardBeacon::builder()
            .name("veggies")
            .length(30)
            .style(BeaconStyle::AsSet(AsSet::builder().build()?))
            .build()?,
        // The work_typeBeacon allows searching on the encrypted work_type attribute
        // We only use it as part of the compound work_unit beacon,
        // so we disable its use as a standalone beacon
        StandardBeacon::builder()
            .name("work_type")
            .length(30)
            .style(BeaconStyle::PartOnly(PartOnly::builder().build()?))
            .build()?,
    ];

    // Here we build a compound beacon from work_id and work_type
    // If we had tried to make a StandardBeacon from work_type, we would have seen an error
    // because work_type is "PartOnly"
    let encrypted_part_list = vec![EncryptedPart::builder()
        .name("work_type")
        .prefix("T-")
        .build()?];

    let signed_part_list = vec![SignedPart::builder().name("work_id").prefix("I-").build()?];

    let compound_beacon_list = vec![CompoundBeacon::builder()
        .name("work_unit")
        .split(".")
        .encrypted(encrypted_part_list)
        .signed(signed_part_list)
        .build()?];

    // 2. Configure the Keystore
    //    These are the same constructions as in the Basic example, which describes these in more detail.
    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let key_store_config = KeyStoreConfig::builder()
        .kms_client(aws_sdk_kms::Client::new(&sdk_config))
        .ddb_client(aws_sdk_dynamodb::Client::new(&sdk_config))
        .ddb_table_name(branch_key_ddb_table_name)
        .logical_key_store_name(branch_key_ddb_table_name)
        .kms_configuration(KmsConfiguration::KmsKeyArn(
            branch_key_wrapping_kms_key_arn.to_string(),
        ))
        .build()?;

    let key_store = keystore_client::Client::from_conf(key_store_config)?;

    // 3. Create BeaconVersion.
    //    This is similar to the Basic example
    let beacon_version = BeaconVersion::builder()
        .standard_beacons(standard_beacon_list)
        .compound_beacons(compound_beacon_list)
        .version(1) // MUST be 1
        .key_store(key_store.clone())
        .key_source(BeaconKeySource::Single(
            SingleKeyStore::builder()
                // `keyId` references a beacon key.
                // For every branch key we create in the keystore,
                // we also create a beacon key.
                // This beacon key is not the same as the branch key,
                // but is created with the same ID as the branch key.
                .key_id(branch_key_id)
                .cache_ttl(6000)
                .build()?,
        ))
        .build()?;
    let beacon_versions = vec![beacon_version];

    // 4. Create a Hierarchical Keyring
    //    This is the same configuration as in the Basic example.
    let mpl_config = MaterialProvidersConfig::builder().build()?;
    let mpl = mpl_client::Client::from_conf(mpl_config)?;
    let kms_keyring = mpl
        .create_aws_kms_hierarchical_keyring()
        .branch_key_id(branch_key_id)
        .key_store(key_store)
        .ttl_seconds(6000)
        .send()
        .await?;

    // 5. Configure which attributes are encrypted and/or signed when writing new items.
    let attribute_actions_on_encrypt = HashMap::from([
        ("work_id".to_string(), CryptoAction::SignOnly), // Our partition attribute must be SIGN_ONLY
        ("inspection_date".to_string(), CryptoAction::SignOnly), // Our sort attribute must be SIGN_ONLY
        ("dessert".to_string(), CryptoAction::EncryptAndSign), // Beaconized attributes must be encrypted
        ("fruit".to_string(), CryptoAction::EncryptAndSign), // Beaconized attributes must be encrypted
        ("basket".to_string(), CryptoAction::EncryptAndSign), // Beaconized attributes must be encrypted
        ("veggies".to_string(), CryptoAction::EncryptAndSign), // Beaconized attributes must be encrypted
        ("work_type".to_string(), CryptoAction::EncryptAndSign), // Beaconized attributes must be encrypted
    ]);

    // 6. Create the DynamoDb Encryption configuration for the table we will be writing to.
    //    The beaconVersions are added to the search configuration.
    let table_config = DynamoDbTableEncryptionConfig::builder()
        .logical_table_name(ddb_table_name)
        .partition_key_name("work_id")
        .sort_key_name("inspection_date")
        .attribute_actions_on_encrypt(attribute_actions_on_encrypt)
        .keyring(kms_keyring)
        .search(
            SearchConfig::builder()
                .write_version(1) // MUST be 1
                .versions(beacon_versions)
                .build()?,
        )
        .build()?;

    // 7. Create config
    let encryption_config = DynamoDbTablesEncryptionConfig::builder()
        .table_encryption_configs(HashMap::from([(ddb_table_name.to_string(), table_config)]))
        .build()?;

    // 8. Create item one, specifically with "dessert != fruit", and "fruit in basket".
    let item1 = HashMap::from([
        ("work_id".to_string(), AttributeValue::S("1".to_string())),
        (
            "inspection_date".to_string(),
            AttributeValue::S("2023-06-13".to_string()),
        ),
        ("dessert".to_string(), AttributeValue::S("cake".to_string())),
        ("fruit".to_string(), AttributeValue::S("banana".to_string())),
        (
            "basket".to_string(),
            AttributeValue::Ss(vec![
                "banana".to_string(),
                "apple".to_string(),
                "pear".to_string(),
            ]),
        ),
        (
            "veggies".to_string(),
            AttributeValue::Ss(vec![
                "beans".to_string(),
                "carrots".to_string(),
                "celery".to_string(),
            ]),
        ),
        (
            "work_type".to_string(),
            AttributeValue::S("small".to_string()),
        ),
    ]);

    // 9. Create item two, specifically with "dessert == fruit", and "fruit not in basket".
    let item2 = HashMap::from([
        ("work_id".to_string(), AttributeValue::S("2".to_string())),
        (
            "inspection_date".to_string(),
            AttributeValue::S("2023-06-13".to_string()),
        ),
        (
            "dessert".to_string(),
            AttributeValue::S("orange".to_string()),
        ),
        ("fruit".to_string(), AttributeValue::S("orange".to_string())),
        (
            "basket".to_string(),
            AttributeValue::Ss(vec![
                "strawberry".to_string(),
                "blueberry".to_string(),
                "blackberry".to_string(),
            ]),
        ),
        (
            "veggies".to_string(),
            AttributeValue::Ss(vec![
                "beans".to_string(),
                "carrots".to_string(),
                "peas".to_string(),
            ]),
        ),
        (
            "work_type".to_string(),
            AttributeValue::S("large".to_string()),
        ),
    ]);

    // 10. Create a new AWS SDK DynamoDb client using the DynamoDb Config above
    let dynamo_config = aws_sdk_dynamodb::config::Builder::from(&sdk_config)
        .interceptor(DbEsdkInterceptor::new(encryption_config)?)
        .build();
    let ddb = aws_sdk_dynamodb::Client::from_conf(dynamo_config);

    // 11. Add the two items
    ddb.put_item()
        .table_name(ddb_table_name)
        .set_item(Some(item1.clone()))
        .send()
        .await?;

    ddb.put_item()
        .table_name(ddb_table_name)
        .set_item(Some(item2.clone()))
        .send()
        .await?;

    // 12. Test the first type of Set operation :
    // Select records where the basket attribute holds a particular value
    let expression_attribute_values = HashMap::from([(
        ":value".to_string(),
        AttributeValue::S("banana".to_string()),
    )]);

    let scan_response = ddb
        .scan()
        .table_name(ddb_table_name)
        .filter_expression("contains(basket, :value)")
        .set_expression_attribute_values(Some(expression_attribute_values.clone()))
        .send()
        .await?;

    let attribute_values = scan_response.items.unwrap();
    // Validate only 1 item was returned: item1
    assert_eq!(attribute_values.len(), 1);
    let returned_item = &attribute_values[0];
    // Validate the item has the expected attributes
    assert_eq!(returned_item["work_id"], item1["work_id"]);

    // 13. Test the second type of Set operation :
    // Select records where the basket attribute holds the fruit attribute
    let scan_response = ddb
        .scan()
        .table_name(ddb_table_name)
        .filter_expression("contains(basket, fruit)")
        .send()
        .await?;

    let attribute_values = scan_response.items.unwrap();
    // Validate only 1 item was returned: item1
    assert_eq!(attribute_values.len(), 1);
    let returned_item = &attribute_values[0];
    // Validate the item has the expected attributes
    assert_eq!(returned_item["work_id"], item1["work_id"]);

    // 14. Test the third type of Set operation :
    // Select records where the fruit attribute exists in a particular set
    let basket3 = vec![
        "boysenberry".to_string(),
        "orange".to_string(),
        "grape".to_string(),
    ];
    let expression_attribute_values =
        HashMap::from([(":value".to_string(), AttributeValue::Ss(basket3))]);

    let scan_response = ddb
        .scan()
        .table_name(ddb_table_name)
        .filter_expression("contains(:value, fruit)")
        .set_expression_attribute_values(Some(expression_attribute_values.clone()))
        .send()
        .await?;

    let attribute_values = scan_response.items.unwrap();
    // Validate only 1 item was returned: item1
    assert_eq!(attribute_values.len(), 1);
    let returned_item = &attribute_values[0];
    // Validate the item has the expected attributes
    assert_eq!(returned_item["work_id"], item2["work_id"]);

    // 15. Test a Shared search. Select records where the dessert attribute matches the fruit attribute
    let scan_response = ddb
        .scan()
        .table_name(ddb_table_name)
        .filter_expression("dessert = fruit")
        .send()
        .await?;

    let attribute_values = scan_response.items.unwrap();
    // Validate only 1 item was returned: item1
    assert_eq!(attribute_values.len(), 1);
    let returned_item = &attribute_values[0];
    // Validate the item has the expected attributes
    assert_eq!(returned_item["work_id"], item2["work_id"]);

    // 15. Test the AsSet attribute 'veggies' :
    // Select records where the veggies attribute holds a particular value
    let expression_attribute_values =
        HashMap::from([(":value".to_string(), AttributeValue::S("peas".to_string()))]);

    let scan_response = ddb
        .scan()
        .table_name(ddb_table_name)
        .filter_expression("contains(veggies, :value)")
        .set_expression_attribute_values(Some(expression_attribute_values.clone()))
        .send()
        .await?;

    let attribute_values = scan_response.items.unwrap();
    // Validate only 1 item was returned: item1
    assert_eq!(attribute_values.len(), 1);
    let returned_item = &attribute_values[0];
    // Validate the item has the expected attributes
    assert_eq!(returned_item["work_id"], item2["work_id"]);

    // 16. Test the compound beacon 'work_unit' :
    let expression_attribute_values = HashMap::from([(
        ":value".to_string(),
        AttributeValue::S("I-1.T-small".to_string()),
    )]);

    let scan_response = ddb
        .scan()
        .table_name(ddb_table_name)
        .filter_expression("work_unit = :value")
        .set_expression_attribute_values(Some(expression_attribute_values.clone()))
        .send()
        .await?;

    let attribute_values = scan_response.items.unwrap();
    // Validate only 1 item was returned: item1
    assert_eq!(attribute_values.len(), 1);
    let returned_item = &attribute_values[0];
    // Validate the item has the expected attributes
    assert_eq!(returned_item["work_id"], item1["work_id"]);

    println!("beacon_styles_searchable_encryption successful.");
    Ok(())
}

examples/searchableencryption/complexexample/beacon_config.rs (line 138)

pub async fn setup_beacon_config(
    ddb_table_name: &str,
    branch_key_id: &str,
    branch_key_wrapping_kms_key_arn: &str,
    branch_key_ddb_table_name: &str,
) -> Result<aws_sdk_dynamodb::Client, crate::BoxError> {
    // 1. Create keystore and branch key
    //    These are the same constructions as in the Basic examples, which describe this in more detail.
    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let key_store_config = KeyStoreConfig::builder()
        .kms_client(aws_sdk_kms::Client::new(&sdk_config))
        .ddb_client(aws_sdk_dynamodb::Client::new(&sdk_config))
        .ddb_table_name(branch_key_ddb_table_name)
        .logical_key_store_name(branch_key_ddb_table_name)
        .kms_configuration(KmsConfiguration::KmsKeyArn(
            branch_key_wrapping_kms_key_arn.to_string(),
        ))
        .build()?;

    let key_store = keystore_client::Client::from_conf(key_store_config)?;

    // 2. Create standard beacons
    //    For this example, we use a standard beacon length of 4.
    //    The BasicSearchableEncryptionExample gives a more thorough consideration of beacon length.
    //    For production applications, one should always exercise rigor when deciding beacon length, including
    //        examining population size and considering performance.
    let standard_beacon_list = vec![
        StandardBeacon::builder()
            .name("EmployeeID")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("TicketNumber")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("ProjectName")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("EmployeeEmail")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("CreatorEmail")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("ProjectStatus")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("OrganizerEmail")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("ManagerEmail")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("AssigneeEmail")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("Severity")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("City")
            .loc("Location.City")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("Building")
            .loc("Location.Building")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("Floor")
            .loc("Location.Floor")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("Room")
            .loc("Location.Room")
            .length(4)
            .build()?,
        StandardBeacon::builder()
            .name("Desk")
            .loc("Location.Desk")
            .length(4)
            .build()?,
    ];

    // 3. Define encrypted parts
    //    Note that some of the prefixes are modified from the suggested prefixes in Demo.md.
    //    This is because all prefixes must be unique in a configuration.
    //    Encrypted parts are described in more detail in the CompoundBeaconSearchableEncryptionExample.
    let encrypted_parts_list = vec![
        EncryptedPart::builder()
            .name("EmployeeID")
            .prefix("E-")
            .build()?,
        EncryptedPart::builder()
            .name("TicketNumber")
            .prefix("T-")
            .build()?,
        EncryptedPart::builder()
            .name("ProjectName")
            .prefix("P-")
            .build()?,
        EncryptedPart::builder()
            .name("EmployeeEmail")
            .prefix("EE-")
            .build()?,
        EncryptedPart::builder()
            .name("CreatorEmail")
            .prefix("CE-")
            .build()?,
        EncryptedPart::builder()
            .name("OrganizerEmail")
            .prefix("OE-")
            .build()?,
        EncryptedPart::builder()
            .name("ManagerEmail")
            .prefix("ME-")
            .build()?,
        EncryptedPart::builder()
            .name("AssigneeEmail")
            .prefix("AE-")
            .build()?,
        EncryptedPart::builder()
            .name("ProjectStatus")
            .prefix("PSts-")
            .build()?,
        EncryptedPart::builder().name("City").prefix("C-").build()?,
        EncryptedPart::builder()
            .name("Severity")
            .prefix("S-")
            .build()?,
        EncryptedPart::builder()
            .name("Building")
            .prefix("B-")
            .build()?,
        EncryptedPart::builder()
            .name("Floor")
            .prefix("F-")
            .build()?,
        EncryptedPart::builder().name("Room").prefix("R-").build()?,
        EncryptedPart::builder().name("Desk").prefix("D-").build()?,
    ];

    // 4. Define signed parts
    //    These are unencrypted attributes we would like to use in beacon queries.
    //    In this example, all of these represent dates or times.
    //    Keeping these attributes unencrypted allows us to use them in comparison-based queries. If a signed
    //        part is the first part in a compound beacon, then that part can be used in comparison for sorting.
    let signed_parts_list = vec![
        SignedPart::builder()
            .name("TicketModTime")
            .prefix("M-")
            .build()?,
        SignedPart::builder()
            .name("MeetingStart")
            .prefix("MS-")
            .build()?,
        SignedPart::builder()
            .name("TimeCardStart")
            .prefix("TC-")
            .build()?,
        SignedPart::builder()
            .name("ProjectStart")
            .prefix("PS-")
            .build()?,
    ];

    // 5. Create constructor parts
    //    Constructor parts are used to assemble constructors (constructors described more in next step).
    //    For each attribute that will be used in a constructor, there must be a corresponding constructor part.
    //    A constructor part must receive:
    //     - name: Name of a standard beacon
    //     - required: Whether this attribute must be present in the item to match a constructor
    //    In this example, we will define each constructor part once and re-use it across multiple constructors.
    //    The parts below are defined by working backwards from the constructors in "PK Constructors",
    //        "SK constructors", etc. sections in Demo.md.
    let employee_id_constructor_part = ConstructorPart::builder()
        .name("EmployeeID")
        .required(true)
        .build()?;
    let ticket_number_constructor_part = ConstructorPart::builder()
        .name("TicketNumber")
        .required(true)
        .build()?;
    let project_name_constructor_part = ConstructorPart::builder()
        .name("ProjectName")
        .required(true)
        .build()?;
    let ticket_mod_time_constructor_part = ConstructorPart::builder()
        .name("TicketModTime")
        .required(true)
        .build()?;
    let meeting_start_constructor_part = ConstructorPart::builder()
        .name("MeetingStart")
        .required(true)
        .build()?;
    let timecard_start_constructor_part = ConstructorPart::builder()
        .name("TimeCardStart")
        .required(true)
        .build()?;
    let employee_email_constructor_part = ConstructorPart::builder()
        .name("EmployeeEmail")
        .required(true)
        .build()?;
    let creator_email_constructor_part = ConstructorPart::builder()
        .name("CreatorEmail")
        .required(true)
        .build()?;
    let project_status_constructor_part = ConstructorPart::builder()
        .name("ProjectStatus")
        .required(true)
        .build()?;
    let organizer_email_constructor_part = ConstructorPart::builder()
        .name("OrganizerEmail")
        .required(true)
        .build()?;
    let project_start_constructor_part = ConstructorPart::builder()
        .name("ProjectStart")
        .required(true)
        .build()?;
    let manager_email_constructor_part = ConstructorPart::builder()
        .name("ManagerEmail")
        .required(true)
        .build()?;
    let assignee_email_constructor_part = ConstructorPart::builder()
        .name("AssigneeEmail")
        .required(true)
        .build()?;
    let city_constructor_part = ConstructorPart::builder()
        .name("City")
        .required(true)
        .build()?;
    let severity_constructor_part = ConstructorPart::builder()
        .name("Severity")
        .required(true)
        .build()?;
    let building_constructor_part = ConstructorPart::builder()
        .name("Building")
        .required(true)
        .build()?;
    let floor_constructor_part = ConstructorPart::builder()
        .name("Floor")
        .required(true)
        .build()?;
    let room_constructor_part = ConstructorPart::builder()
        .name("Room")
        .required(true)
        .build()?;
    let desk_constructor_part = ConstructorPart::builder()
        .name("Desk")
        .required(true)
        .build()?;

    // 6. Define constructors
    //    Constructors define how encrypted and signed parts are assembled into compound beacons.
    //    The constructors below are based off of the "PK Constructors", "SK constructors", etc. sections in Demo.md.

    // The employee ID constructor only requires an employee ID.
    // If an item has an attribute with name "EmployeeID", it will match this constructor.
    // If this is the first matching constructor in the constructor list (constructor list described more below),
    //     the compound beacon will use this constructor, and the compound beacon will be written as `E-X`.

    let employee_id_constructor = Constructor::builder()
        .parts(vec![employee_id_constructor_part])
        .build()?;
    let ticket_number_constructor = Constructor::builder()
        .parts(vec![ticket_number_constructor_part])
        .build()?;
    let project_name_constructor = Constructor::builder()
        .parts(vec![project_name_constructor_part])
        .build()?;
    let ticket_mod_time_constructor = Constructor::builder()
        .parts(vec![ticket_mod_time_constructor_part])
        .build()?;
    let building_constructor = Constructor::builder()
        .parts(vec![building_constructor_part.clone()])
        .build()?;

    // This constructor requires all of "MeetingStart", "Location.Floor", and "Location.Room" attributes.
    // If an item has all of these attributes, it will match this constructor.
    // If this is the first matching constructor in the constructor list (constructor list described more below),
    //     the compound beacon will use this constructor, and the compound beacon will be written as `MS-X~F-Y~R-Z`.
    // In a constructor with multiple constructor parts, the order the constructor parts are added to
    //     the constructor part list defines how the compound beacon is written.
    // We can rearrange the beacon parts by changing the order the constructors were added to the list.
    let meeting_start_floor_room_constructor = Constructor::builder()
        .parts(vec![
            meeting_start_constructor_part,
            floor_constructor_part.clone(),
            room_constructor_part,
        ])
        .build()?;

    let timecard_start_constructor = Constructor::builder()
        .parts(vec![timecard_start_constructor_part.clone()])
        .build()?;
    let timecard_start_employee_email_constructor = Constructor::builder()
        .parts(vec![
            timecard_start_constructor_part,
            employee_email_constructor_part.clone(),
        ])
        .build()?;
    let creator_email_constructor = Constructor::builder()
        .parts(vec![creator_email_constructor_part])
        .build()?;
    let project_status_constructor = Constructor::builder()
        .parts(vec![project_status_constructor_part])
        .build()?;
    let employee_email_constructor = Constructor::builder()
        .parts(vec![employee_email_constructor_part])
        .build()?;
    let organizer_email_constructor = Constructor::builder()
        .parts(vec![organizer_email_constructor_part])
        .build()?;
    let project_start_constructor = Constructor::builder()
        .parts(vec![project_start_constructor_part])
        .build()?;
    let manager_email_constructor = Constructor::builder()
        .parts(vec![manager_email_constructor_part])
        .build()?;
    let assignee_email_constructor = Constructor::builder()
        .parts(vec![assignee_email_constructor_part])
        .build()?;
    let city_constructor = Constructor::builder()
        .parts(vec![city_constructor_part])
        .build()?;
    let severity_constructor = Constructor::builder()
        .parts(vec![severity_constructor_part])
        .build()?;
    let building_floor_desk_constructor = Constructor::builder()
        .parts(vec![
            building_constructor_part,
            floor_constructor_part,
            desk_constructor_part,
        ])
        .build()?;

    // 7. Add constructors to the compound beacon constructor list in desired construction order
    //    In a compound beacon with multiple constructors, the order the constructors are added to
    //        the constructor list determines their priority.
    //    The first constructor added to a constructor list will be the first constructor that is executed.
    //    The client will evaluate constructors until one matches, and will use the first one that matches.
    //    If no constructors match, an attribute value is not written for that beacon.
    //    A general strategy is to add constructors with unique conditions at the beginning of the list,
    //       and add constructors with general conditions at the end of the list. This would allow a given
    //       item to trigger the constructor most specific to its attributes.
    let pk0_constructor_list = vec![
        employee_id_constructor.clone(),
        building_constructor,
        ticket_number_constructor,
        project_name_constructor.clone(),
    ];
    let sk0_constructor_list = vec![
        ticket_mod_time_constructor.clone(),
        meeting_start_floor_room_constructor.clone(),
        timecard_start_employee_email_constructor,
        project_name_constructor,
        employee_id_constructor.clone(),
    ];
    let pk1_constructor_list = vec![
        creator_email_constructor,
        employee_email_constructor,
        project_status_constructor,
        organizer_email_constructor,
    ];
    let sk1_constructor_list = vec![
        meeting_start_floor_room_constructor,
        timecard_start_constructor,
        ticket_mod_time_constructor.clone(),
        project_start_constructor,
        employee_id_constructor,
    ];
    let pk2_constructor_list = vec![manager_email_constructor, assignee_email_constructor];
    let pk3_constructor_list = vec![city_constructor, severity_constructor];
    let sk3_constructor_list = vec![building_floor_desk_constructor, ticket_mod_time_constructor];

    // 8. Define compound beacons
    //    Compound beacon construction is defined in more detail in CompoundBeaconSearchableEncryptionExample.
    //    Note that the split character must be a character that is not used in any attribute value.
    let compound_beacon_list = vec![
        CompoundBeacon::builder()
            .name("PK")
            .split("~")
            .constructors(pk0_constructor_list)
            .build()?,
        CompoundBeacon::builder()
            .name("SK")
            .split("~")
            .constructors(sk0_constructor_list)
            .build()?,
        CompoundBeacon::builder()
            .name("PK1")
            .split("~")
            .constructors(pk1_constructor_list)
            .build()?,
        CompoundBeacon::builder()
            .name("SK1")
            .split("~")
            .constructors(sk1_constructor_list)
            .build()?,
        CompoundBeacon::builder()
            .name("PK2")
            .split("~")
            .constructors(pk2_constructor_list)
            .build()?,
        CompoundBeacon::builder()
            .name("PK3")
            .split("~")
            .constructors(pk3_constructor_list)
            .build()?,
        CompoundBeacon::builder()
            .name("SK3")
            .split("~")
            .constructors(sk3_constructor_list)
            .build()?,
    ];

    // 9. Create BeaconVersion
    let beacon_versions = BeaconVersion::builder()
        .standard_beacons(standard_beacon_list)
        .compound_beacons(compound_beacon_list)
        .encrypted_parts(encrypted_parts_list)
        .signed_parts(signed_parts_list)
        .version(1)
        .key_store(key_store.clone())
        .key_source(BeaconKeySource::Single(
            SingleKeyStore::builder()
                .key_id(branch_key_id)
                .cache_ttl(6000)
                .build()?,
        ))
        .build()?;
    let beacon_versions = vec![beacon_versions];

    // 10. Create a Hierarchical Keyring
    let mpl_config = MaterialProvidersConfig::builder().build()?;
    let mpl = mpl_client::Client::from_conf(mpl_config)?;
    let kms_keyring = mpl
        .create_aws_kms_hierarchical_keyring()
        .branch_key_id(branch_key_id)
        .key_store(key_store)
        .ttl_seconds(600)
        .send()
        .await?;

    // 11. Define crypto actions
    let attribute_actions_on_encrypt = HashMap::from([
        // Our partition key must be configured as SIGN_ONLY
        ("partition_key".to_string(), CryptoAction::SignOnly),
        // Attributes used in beacons must be configured as ENCRYPT_AND_SIGN
        ("EmployeeID".to_string(), CryptoAction::EncryptAndSign),
        ("TicketNumber".to_string(), CryptoAction::EncryptAndSign),
        ("ProjectName".to_string(), CryptoAction::EncryptAndSign),
        ("EmployeeName".to_string(), CryptoAction::EncryptAndSign),
        ("EmployeeEmail".to_string(), CryptoAction::EncryptAndSign),
        ("CreatorEmail".to_string(), CryptoAction::EncryptAndSign),
        ("ProjectStatus".to_string(), CryptoAction::EncryptAndSign),
        ("OrganizerEmail".to_string(), CryptoAction::EncryptAndSign),
        ("ManagerEmail".to_string(), CryptoAction::EncryptAndSign),
        ("AssigneeEmail".to_string(), CryptoAction::EncryptAndSign),
        ("City".to_string(), CryptoAction::EncryptAndSign),
        ("Severity".to_string(), CryptoAction::EncryptAndSign),
        ("Location".to_string(), CryptoAction::EncryptAndSign),
        // These are not beaconized attributes, but are sensitive data that must be encrypted
        ("Attendees".to_string(), CryptoAction::EncryptAndSign),
        ("Subject".to_string(), CryptoAction::EncryptAndSign),
        // Signed parts and unencrypted attributes can be configured as SIGN_ONLY or DO_NOTHING
        // For this example, we will set these to SIGN_ONLY to ensure authenticity
        ("TicketModTime".to_string(), CryptoAction::SignOnly),
        ("MeetingStart".to_string(), CryptoAction::SignOnly),
        ("TimeCardStart".to_string(), CryptoAction::SignOnly),
        ("EmployeeTitle".to_string(), CryptoAction::SignOnly),
        ("Description".to_string(), CryptoAction::SignOnly),
        ("ProjectTarget".to_string(), CryptoAction::SignOnly),
        ("Hours".to_string(), CryptoAction::SignOnly),
        ("Role".to_string(), CryptoAction::SignOnly),
        ("Message".to_string(), CryptoAction::SignOnly),
        ("ProjectStart".to_string(), CryptoAction::SignOnly),
        ("Duration".to_string(), CryptoAction::SignOnly),
    ]);

    // 12. Set up table config
    let table_config = DynamoDbTableEncryptionConfig::builder()
        .logical_table_name(ddb_table_name)
        .partition_key_name("partition_key")
        .attribute_actions_on_encrypt(attribute_actions_on_encrypt)
        .keyring(kms_keyring)
        .search(
            SearchConfig::builder()
                .write_version(1)
                .versions(beacon_versions)
                .build()?,
        )
        .build()?;

    let table_configs = DynamoDbTablesEncryptionConfig::builder()
        .table_encryption_configs(HashMap::from([(ddb_table_name.to_string(), table_config)]))
        .build()?;

    // 13. Create a new AWS SDK DynamoDb client using the config above
    let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
    let dynamo_config = aws_sdk_dynamodb::config::Builder::from(&sdk_config)
        .interceptor(DbEsdkInterceptor::new(table_configs)?)
        .build();

    Ok(aws_sdk_dynamodb::Client::from_conf(dynamo_config))
}

Trait Implementations

impl Clone for EncryptedPart

fn clone(&self) -> EncryptedPart

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EncryptedPart

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for EncryptedPart

fn eq(&self, other: &EncryptedPart) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for EncryptedPart