Struct Client

Source

pub struct Client { /* private fields */ }

Implementations§

Source §

impl Client

Source

pub fn encrypt_item(&self) -> EncryptItemFluentBuilder

Constructs a fluent builder for the EncryptItem operation.

The fluent builder is configurable:
- plaintext_item(impl Into<Option<::std::collections::HashMap<::std::string::String, aws_sdk_dynamodb::types::AttributeValue>>>) / set_plaintext_item(Option<::std::collections::HashMap<::std::string::String, aws_sdk_dynamodb::types::AttributeValue>>): (undocumented)
On success, responds with EncryptItemOutput with field(s):
- encrypted_item(Option<::std::collections::HashMap<::std::string::String, aws_sdk_dynamodb::types::AttributeValue>>): (undocumented)
- parsed_header(Option<crate::deps::aws_cryptography_dbEncryptionSdk_dynamoDb_itemEncryptor::types::ParsedHeader>): (undocumented)
On failure, responds with SdkError<EncryptItemError>

Examples found in repository ?

examples/itemencryptor/item_encrypt_decrypt.rs (line 140)

34pub async fn encrypt_decrypt() -> Result<(), crate::BoxError> {
35    let kms_key_id = test_utils::TEST_KMS_KEY_ID;
36    let ddb_table_name = test_utils::TEST_DDB_TABLE_NAME;
37
38    // 1. Create a Keyring. This Keyring will be responsible for protecting the data keys that protect your data.
39    //    For this example, we will create a AWS KMS Keyring with the AWS KMS Key we want to use.
40    //    We will use the `CreateMrkMultiKeyring` method to create this keyring,
41    //    as it will correctly handle both single region and Multi-Region KMS Keys.
42    let provider_config = MaterialProvidersConfig::builder().build()?;
43    let mat_prov = mpl_client::Client::from_conf(provider_config)?;
44    let kms_keyring = mat_prov
45        .create_aws_kms_mrk_multi_keyring()
46        .generator(kms_key_id)
47        .send()
48        .await?;
49
50    // 2. Configure which attributes are encrypted and/or signed when writing new items.
51    //    For each attribute that may exist on the items we plan to write to our DynamoDbTable,
52    //    we must explicitly configure how they should be treated during item encryption:
53    //      - ENCRYPT_AND_SIGN: The attribute is encrypted and included in the signature
54    //      - SIGN_ONLY: The attribute not encrypted, but is still included in the signature
55    //      - DO_NOTHING: The attribute is not encrypted and not included in the signature
56    let attribute_actions_on_encrypt = HashMap::from([
57        ("partition_key".to_string(), CryptoAction::SignOnly),
58        ("sort_key".to_string(), CryptoAction::SignOnly),
59        ("attribute1".to_string(), CryptoAction::EncryptAndSign),
60        ("attribute2".to_string(), CryptoAction::SignOnly),
61        (":attribute3".to_string(), CryptoAction::DoNothing),
62    ]);
63
64    // 3. Configure which attributes we expect to be included in the signature
65    //    when reading items. There are two options for configuring this:
66    //
67    //    - (Recommended) Configure `allowedUnsignedAttributesPrefix`:
68    //      When defining your DynamoDb schema and deciding on attribute names,
69    //      choose a distinguishing prefix (such as ":") for all attributes that
70    //      you do not want to include in the signature.
71    //      This has two main benefits:
72    //      - It is easier to reason about the security and authenticity of data within your item
73    //        when all unauthenticated data is easily distinguishable by their attribute name.
74    //      - If you need to add new unauthenticated attributes in the future,
75    //        you can easily make the corresponding update to your `attributeActionsOnEncrypt`
76    //        and immediately start writing to that new attribute, without
77    //        any other configuration update needed.
78    //      Once you configure this field, it is not safe to update it.
79    //
80    //    - Configure `allowedUnsignedAttributes`: You may also explicitly list
81    //      a set of attributes that should be considered unauthenticated when encountered
82    //      on read. Be careful if you use this configuration. Do not remove an attribute
83    //      name from this configuration, even if you are no longer writing with that attribute,
84    //      as old items may still include this attribute, and our configuration needs to know
85    //      to continue to exclude this attribute from the signature scope.
86    //      If you add new attribute names to this field, you must first deploy the update to this
87    //      field to all readers in your host fleet before deploying the update to start writing
88    //      with that new attribute.
89    //
90    //   For this example, we have designed our DynamoDb table such that any attribute name with
91    //   the ":" prefix should be considered unauthenticated.
92    const UNSIGNED_ATTR_PREFIX: &str = ":";
93
94    // 4. Create the configuration for the DynamoDb Item Encryptor
95    let config = DynamoDbItemEncryptorConfig::builder()
96        .logical_table_name(ddb_table_name)
97        .partition_key_name("partition_key")
98        .sort_key_name("sort_key")
99        .attribute_actions_on_encrypt(attribute_actions_on_encrypt)
100        .keyring(kms_keyring)
101        .allowed_unsigned_attribute_prefix(UNSIGNED_ATTR_PREFIX)
102        // Specifying an algorithm suite is not required,
103        // but is done here to demonstrate how to do so.
104        // We suggest using the
105        // `ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384` suite,
106        // which includes AES-GCM with key derivation, signing, and key commitment.
107        // This is also the default algorithm suite if one is not specified in this config.
108        // For more information on supported algorithm suites, see:
109        //   https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/supported-algorithms.html
110        .algorithm_suite_id(
111            DbeAlgorithmSuiteId::AlgAes256GcmHkdfSha512CommitKeyEcdsaP384SymsigHmacSha384,
112        )
113        .build()?;
114
115    // 5. Create the DynamoDb Item Encryptor
116    let item_encryptor = enc_client::Client::from_conf(config)?;
117
118    // 6. Directly encrypt a DynamoDb item using the DynamoDb Item Encryptor
119    let original_item = HashMap::from([
120        (
121            "partition_key".to_string(),
122            AttributeValue::S("ItemEncryptDecryptExample".to_string()),
123        ),
124        ("sort_key".to_string(), AttributeValue::N("0".to_string())),
125        (
126            "attribute1".to_string(),
127            AttributeValue::S("encrypt and sign me!".to_string()),
128        ),
129        (
130            "attribute2".to_string(),
131            AttributeValue::S("sign me!".to_string()),
132        ),
133        (
134            ":attribute3".to_string(),
135            AttributeValue::S("ignore me!".to_string()),
136        ),
137    ]);
138
139    let encrypted_item = item_encryptor
140        .encrypt_item()
141        .plaintext_item(original_item.clone())
142        .send()
143        .await?
144        .encrypted_item
145        .unwrap();
146
147    // Demonstrate that the item has been encrypted
148    assert_eq!(
149        encrypted_item["partition_key"],
150        AttributeValue::S("ItemEncryptDecryptExample".to_string())
151    );
152    assert_eq!(
153        encrypted_item["sort_key"],
154        AttributeValue::N("0".to_string())
155    );
156    assert!(encrypted_item["attribute1"].is_b());
157    assert!(!encrypted_item["attribute1"].is_s());
158
159    // 7. Directly decrypt the encrypted item using the DynamoDb Item Encryptor
160    let decrypted_item = item_encryptor
161        .decrypt_item()
162        .encrypted_item(encrypted_item)
163        .send()
164        .await?
165        .plaintext_item
166        .unwrap();
167
168    // Demonstrate that GetItem succeeded and returned the decrypted item
169    assert_eq!(decrypted_item, original_item);
170    println!("encrypt_decrypt successful.");
171    Ok(())
172}

Source §

impl Client

Source

pub fn decrypt_item(&self) -> DecryptItemFluentBuilder

Constructs a fluent builder for the DecryptItem operation.

The fluent builder is configurable:
- encrypted_item(impl Into<Option<::std::collections::HashMap<::std::string::String, aws_sdk_dynamodb::types::AttributeValue>>>) / set_encrypted_item(Option<::std::collections::HashMap<::std::string::String, aws_sdk_dynamodb::types::AttributeValue>>): (undocumented)
On success, responds with DecryptItemOutput with field(s):
- parsed_header(Option<crate::deps::aws_cryptography_dbEncryptionSdk_dynamoDb_itemEncryptor::types::ParsedHeader>): (undocumented)
- plaintext_item(Option<::std::collections::HashMap<::std::string::String, aws_sdk_dynamodb::types::AttributeValue>>): (undocumented)
On failure, responds with SdkError<DecryptItemError>

Examples found in repository ?

examples/itemencryptor/item_encrypt_decrypt.rs (line 161)

34pub async fn encrypt_decrypt() -> Result<(), crate::BoxError> {
35    let kms_key_id = test_utils::TEST_KMS_KEY_ID;
36    let ddb_table_name = test_utils::TEST_DDB_TABLE_NAME;
37
38    // 1. Create a Keyring. This Keyring will be responsible for protecting the data keys that protect your data.
39    //    For this example, we will create a AWS KMS Keyring with the AWS KMS Key we want to use.
40    //    We will use the `CreateMrkMultiKeyring` method to create this keyring,
41    //    as it will correctly handle both single region and Multi-Region KMS Keys.
42    let provider_config = MaterialProvidersConfig::builder().build()?;
43    let mat_prov = mpl_client::Client::from_conf(provider_config)?;
44    let kms_keyring = mat_prov
45        .create_aws_kms_mrk_multi_keyring()
46        .generator(kms_key_id)
47        .send()
48        .await?;
49
50    // 2. Configure which attributes are encrypted and/or signed when writing new items.
51    //    For each attribute that may exist on the items we plan to write to our DynamoDbTable,
52    //    we must explicitly configure how they should be treated during item encryption:
53    //      - ENCRYPT_AND_SIGN: The attribute is encrypted and included in the signature
54    //      - SIGN_ONLY: The attribute not encrypted, but is still included in the signature
55    //      - DO_NOTHING: The attribute is not encrypted and not included in the signature
56    let attribute_actions_on_encrypt = HashMap::from([
57        ("partition_key".to_string(), CryptoAction::SignOnly),
58        ("sort_key".to_string(), CryptoAction::SignOnly),
59        ("attribute1".to_string(), CryptoAction::EncryptAndSign),
60        ("attribute2".to_string(), CryptoAction::SignOnly),
61        (":attribute3".to_string(), CryptoAction::DoNothing),
62    ]);
63
64    // 3. Configure which attributes we expect to be included in the signature
65    //    when reading items. There are two options for configuring this:
66    //
67    //    - (Recommended) Configure `allowedUnsignedAttributesPrefix`:
68    //      When defining your DynamoDb schema and deciding on attribute names,
69    //      choose a distinguishing prefix (such as ":") for all attributes that
70    //      you do not want to include in the signature.
71    //      This has two main benefits:
72    //      - It is easier to reason about the security and authenticity of data within your item
73    //        when all unauthenticated data is easily distinguishable by their attribute name.
74    //      - If you need to add new unauthenticated attributes in the future,
75    //        you can easily make the corresponding update to your `attributeActionsOnEncrypt`
76    //        and immediately start writing to that new attribute, without
77    //        any other configuration update needed.
78    //      Once you configure this field, it is not safe to update it.
79    //
80    //    - Configure `allowedUnsignedAttributes`: You may also explicitly list
81    //      a set of attributes that should be considered unauthenticated when encountered
82    //      on read. Be careful if you use this configuration. Do not remove an attribute
83    //      name from this configuration, even if you are no longer writing with that attribute,
84    //      as old items may still include this attribute, and our configuration needs to know
85    //      to continue to exclude this attribute from the signature scope.
86    //      If you add new attribute names to this field, you must first deploy the update to this
87    //      field to all readers in your host fleet before deploying the update to start writing
88    //      with that new attribute.
89    //
90    //   For this example, we have designed our DynamoDb table such that any attribute name with
91    //   the ":" prefix should be considered unauthenticated.
92    const UNSIGNED_ATTR_PREFIX: &str = ":";
93
94    // 4. Create the configuration for the DynamoDb Item Encryptor
95    let config = DynamoDbItemEncryptorConfig::builder()
96        .logical_table_name(ddb_table_name)
97        .partition_key_name("partition_key")
98        .sort_key_name("sort_key")
99        .attribute_actions_on_encrypt(attribute_actions_on_encrypt)
100        .keyring(kms_keyring)
101        .allowed_unsigned_attribute_prefix(UNSIGNED_ATTR_PREFIX)
102        // Specifying an algorithm suite is not required,
103        // but is done here to demonstrate how to do so.
104        // We suggest using the
105        // `ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384` suite,
106        // which includes AES-GCM with key derivation, signing, and key commitment.
107        // This is also the default algorithm suite if one is not specified in this config.
108        // For more information on supported algorithm suites, see:
109        //   https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/supported-algorithms.html
110        .algorithm_suite_id(
111            DbeAlgorithmSuiteId::AlgAes256GcmHkdfSha512CommitKeyEcdsaP384SymsigHmacSha384,
112        )
113        .build()?;
114
115    // 5. Create the DynamoDb Item Encryptor
116    let item_encryptor = enc_client::Client::from_conf(config)?;
117
118    // 6. Directly encrypt a DynamoDb item using the DynamoDb Item Encryptor
119    let original_item = HashMap::from([
120        (
121            "partition_key".to_string(),
122            AttributeValue::S("ItemEncryptDecryptExample".to_string()),
123        ),
124        ("sort_key".to_string(), AttributeValue::N("0".to_string())),
125        (
126            "attribute1".to_string(),
127            AttributeValue::S("encrypt and sign me!".to_string()),
128        ),
129        (
130            "attribute2".to_string(),
131            AttributeValue::S("sign me!".to_string()),
132        ),
133        (
134            ":attribute3".to_string(),
135            AttributeValue::S("ignore me!".to_string()),
136        ),
137    ]);
138
139    let encrypted_item = item_encryptor
140        .encrypt_item()
141        .plaintext_item(original_item.clone())
142        .send()
143        .await?
144        .encrypted_item
145        .unwrap();
146
147    // Demonstrate that the item has been encrypted
148    assert_eq!(
149        encrypted_item["partition_key"],
150        AttributeValue::S("ItemEncryptDecryptExample".to_string())
151    );
152    assert_eq!(
153        encrypted_item["sort_key"],
154        AttributeValue::N("0".to_string())
155    );
156    assert!(encrypted_item["attribute1"].is_b());
157    assert!(!encrypted_item["attribute1"].is_s());
158
159    // 7. Directly decrypt the encrypted item using the DynamoDb Item Encryptor
160    let decrypted_item = item_encryptor
161        .decrypt_item()
162        .encrypted_item(encrypted_item)
163        .send()
164        .await?
165        .plaintext_item
166        .unwrap();
167
168    // Demonstrate that GetItem succeeded and returned the decrypted item
169    assert_eq!(decrypted_item, original_item);
170    println!("encrypt_decrypt successful.");
171    Ok(())
172}

Source §

impl Client

Source

pub fn from_conf(input: DynamoDbItemEncryptorConfig) -> Result<Self, Error>

Creates a new client from the service Config.

Examples found in repository ?

examples/itemencryptor/item_encrypt_decrypt.rs (line 116)

34pub async fn encrypt_decrypt() -> Result<(), crate::BoxError> {
35    let kms_key_id = test_utils::TEST_KMS_KEY_ID;
36    let ddb_table_name = test_utils::TEST_DDB_TABLE_NAME;
37
38    // 1. Create a Keyring. This Keyring will be responsible for protecting the data keys that protect your data.
39    //    For this example, we will create a AWS KMS Keyring with the AWS KMS Key we want to use.
40    //    We will use the `CreateMrkMultiKeyring` method to create this keyring,
41    //    as it will correctly handle both single region and Multi-Region KMS Keys.
42    let provider_config = MaterialProvidersConfig::builder().build()?;
43    let mat_prov = mpl_client::Client::from_conf(provider_config)?;
44    let kms_keyring = mat_prov
45        .create_aws_kms_mrk_multi_keyring()
46        .generator(kms_key_id)
47        .send()
48        .await?;
49
50    // 2. Configure which attributes are encrypted and/or signed when writing new items.
51    //    For each attribute that may exist on the items we plan to write to our DynamoDbTable,
52    //    we must explicitly configure how they should be treated during item encryption:
53    //      - ENCRYPT_AND_SIGN: The attribute is encrypted and included in the signature
54    //      - SIGN_ONLY: The attribute not encrypted, but is still included in the signature
55    //      - DO_NOTHING: The attribute is not encrypted and not included in the signature
56    let attribute_actions_on_encrypt = HashMap::from([
57        ("partition_key".to_string(), CryptoAction::SignOnly),
58        ("sort_key".to_string(), CryptoAction::SignOnly),
59        ("attribute1".to_string(), CryptoAction::EncryptAndSign),
60        ("attribute2".to_string(), CryptoAction::SignOnly),
61        (":attribute3".to_string(), CryptoAction::DoNothing),
62    ]);
63
64    // 3. Configure which attributes we expect to be included in the signature
65    //    when reading items. There are two options for configuring this:
66    //
67    //    - (Recommended) Configure `allowedUnsignedAttributesPrefix`:
68    //      When defining your DynamoDb schema and deciding on attribute names,
69    //      choose a distinguishing prefix (such as ":") for all attributes that
70    //      you do not want to include in the signature.
71    //      This has two main benefits:
72    //      - It is easier to reason about the security and authenticity of data within your item
73    //        when all unauthenticated data is easily distinguishable by their attribute name.
74    //      - If you need to add new unauthenticated attributes in the future,
75    //        you can easily make the corresponding update to your `attributeActionsOnEncrypt`
76    //        and immediately start writing to that new attribute, without
77    //        any other configuration update needed.
78    //      Once you configure this field, it is not safe to update it.
79    //
80    //    - Configure `allowedUnsignedAttributes`: You may also explicitly list
81    //      a set of attributes that should be considered unauthenticated when encountered
82    //      on read. Be careful if you use this configuration. Do not remove an attribute
83    //      name from this configuration, even if you are no longer writing with that attribute,
84    //      as old items may still include this attribute, and our configuration needs to know
85    //      to continue to exclude this attribute from the signature scope.
86    //      If you add new attribute names to this field, you must first deploy the update to this
87    //      field to all readers in your host fleet before deploying the update to start writing
88    //      with that new attribute.
89    //
90    //   For this example, we have designed our DynamoDb table such that any attribute name with
91    //   the ":" prefix should be considered unauthenticated.
92    const UNSIGNED_ATTR_PREFIX: &str = ":";
93
94    // 4. Create the configuration for the DynamoDb Item Encryptor
95    let config = DynamoDbItemEncryptorConfig::builder()
96        .logical_table_name(ddb_table_name)
97        .partition_key_name("partition_key")
98        .sort_key_name("sort_key")
99        .attribute_actions_on_encrypt(attribute_actions_on_encrypt)
100        .keyring(kms_keyring)
101        .allowed_unsigned_attribute_prefix(UNSIGNED_ATTR_PREFIX)
102        // Specifying an algorithm suite is not required,
103        // but is done here to demonstrate how to do so.
104        // We suggest using the
105        // `ALG_AES_256_GCM_HKDF_SHA512_COMMIT_KEY_ECDSA_P384_SYMSIG_HMAC_SHA384` suite,
106        // which includes AES-GCM with key derivation, signing, and key commitment.
107        // This is also the default algorithm suite if one is not specified in this config.
108        // For more information on supported algorithm suites, see:
109        //   https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/supported-algorithms.html
110        .algorithm_suite_id(
111            DbeAlgorithmSuiteId::AlgAes256GcmHkdfSha512CommitKeyEcdsaP384SymsigHmacSha384,
112        )
113        .build()?;
114
115    // 5. Create the DynamoDb Item Encryptor
116    let item_encryptor = enc_client::Client::from_conf(config)?;
117
118    // 6. Directly encrypt a DynamoDb item using the DynamoDb Item Encryptor
119    let original_item = HashMap::from([
120        (
121            "partition_key".to_string(),
122            AttributeValue::S("ItemEncryptDecryptExample".to_string()),
123        ),
124        ("sort_key".to_string(), AttributeValue::N("0".to_string())),
125        (
126            "attribute1".to_string(),
127            AttributeValue::S("encrypt and sign me!".to_string()),
128        ),
129        (
130            "attribute2".to_string(),
131            AttributeValue::S("sign me!".to_string()),
132        ),
133        (
134            ":attribute3".to_string(),
135            AttributeValue::S("ignore me!".to_string()),
136        ),
137    ]);
138
139    let encrypted_item = item_encryptor
140        .encrypt_item()
141        .plaintext_item(original_item.clone())
142        .send()
143        .await?
144        .encrypted_item
145        .unwrap();
146
147    // Demonstrate that the item has been encrypted
148    assert_eq!(
149        encrypted_item["partition_key"],
150        AttributeValue::S("ItemEncryptDecryptExample".to_string())
151    );
152    assert_eq!(
153        encrypted_item["sort_key"],
154        AttributeValue::N("0".to_string())
155    );
156    assert!(encrypted_item["attribute1"].is_b());
157    assert!(!encrypted_item["attribute1"].is_s());
158
159    // 7. Directly decrypt the encrypted item using the DynamoDb Item Encryptor
160    let decrypted_item = item_encryptor
161        .decrypt_item()
162        .encrypted_item(encrypted_item)
163        .send()
164        .await?
165        .plaintext_item
166        .unwrap();
167
168    // Demonstrate that GetItem succeeded and returned the decrypted item
169    assert_eq!(decrypted_item, original_item);
170    println!("encrypt_decrypt successful.");
171    Ok(())
172}

Trait Implementations§

Source §

impl Clone for Client

Source §

fn clone(&self) -> Client

Returns a duplicate of the value. Read more

1.0.0 · Source§

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source. Read more

Source §

impl Debug for Client

Source §

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more

Source §

impl PartialEq for Client

Source §

fn eq(&self, other: &Client) -> bool

Tests for self and other values to be equal, and is used by ==.

1.0.0 · Source§

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

Source §

impl StructuralPartialEq for Client

Auto Trait Implementations§

§

impl !UnwindSafe for Client

Blanket Implementations§

Source §

impl<T> Any for T
where T: 'static + ?Sized,

Source §

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more

Source §

impl<T> AnyRef for T
where T: 'static,

Source §

fn as_any_ref(&self) -> &(dyn Any + 'static)

Source §

impl<T> Borrow<T> for T
where T: ?Sized,

Source §

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more

Source §

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source §

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more

Source §

impl<T> CloneToUninit for T
where T: Clone,

Source §

unsafe fn clone_to_uninit(&self, dest: *mut u8)

🔬This is a nightly-only experimental API. (clone_to_uninit)

Performs copy-assignment from self to dest. Read more

Source §

impl<T> From<T> for T

Source §

fn from(t: T) -> T

Returns the argument unchanged.

Source §

impl<T> Instrument for T

Source §

fn instrument(self, span: Span) -> Instrumented<Self>

Instruments this type with the provided Span, returning an Instrumented wrapper. Read more

Source §

fn in_current_span(self) -> Instrumented<Self>

Instruments this type with the current Span, returning an Instrumented wrapper. Read more

Source §

impl<T, U> Into for T
where U: From<T>,

Source §

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source §

impl<T> IntoEither for T

Source §

fn into_either(self, into_left: bool) -> Either<Self, Self>

Converts self into a Left variant of Either<Self, Self> if into_left is true. Converts self into a Right variant of Either<Self, Self> otherwise. Read more

Source §

fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
where F: FnOnce(&Self) -> bool,

Converts self into a Left variant of Either<Self, Self> if into_left(&self) returns true. Converts self into a Right variant of Either<Self, Self> otherwise. Read more

Source §