aws_db_esdk/
lib.rs

1// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2// SPDX-License-Identifier: Apache-2.0
3
4//! The AWS Database Encryption SDK provides client side encryption for DynamoDB.
5//!
6//! The journey starts with a configuration.
7//! For details see the [Examples](https://github.com/aws/aws-database-encryption-sdk-dynamodb/tree/main/releases/rust/db_esdk/examples)
8//! or the [Developer Guide](https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide)
9//!
10//! The examples below will use an empty configuration for brevity.
11//! This is not something you would do in actual use.
12//!
13//! There are two modes of operation.
14//!
15//! ## DynamoDB Client with Interceptor
16//! By far the most common mode is to add our interceptor to your DynamoDB client.
17//!
18//! Once you've created your augmented DynamoDB Client, use it as you normally would.
19//! Values are automatically encrypted on Put and decrypted on Get.
20//!
21//! If configured, Scan Beacons are generated to allow [Searchable Encryption](https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/searchable-encryption.html)
22//!
23//! [See full example](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/releases/rust/db_esdk/examples/basic_get_put_example.rs)
24//!
25//! ```text
26//! let table_configs = DynamoDbTablesEncryptionConfig::builder()
27//! .table_encryption_configs(HashMap::new()) // your configuration here
28//! .build()?;
29//!
30//! let sdk_config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
31//! let dynamo_config = aws_sdk_dynamodb::config::Builder::from(&sdk_config)
32//! .interceptor(DbEsdkInterceptor::new(table_configs)?)
33//! .build();
34//!
35//! let ddb_client = aws_sdk_dynamodb::Client::from_conf(dynamo_config);
36//! ```
37//!
38//! ## Item Encryptor
39//!
40//! Rather than letting things happen automatically, you can manually encrypt
41//! and decrypt individual DynamoDB Items.
42//! This does NOT allow for [Searchable Encryption](https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/searchable-encryption.html).
43//!
44//! [See full example](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/releases/rust/db_esdk/examples/itemencryptor/item_encrypt_decrypt.rs)
45//!
46//! ```text
47//!  let config = DynamoDbItemEncryptorConfig::builder()
48//! // your configuration here
49//!  .build()?;
50//!
51//! let item_encryptor = enc_client::Client::from_conf(config)?;
52//!
53//! let encrypted_item = item_encryptor
54//!   .encrypt_item()
55//!   .plaintext_item(original_item)
56//!   .send()
57//!   .await?
58//!   .encrypted_item
59//!   .unwrap();
60//!
61//! let decrypted_item = item_encryptor
62//!   .decrypt_item()
63//!   .encrypted_item(encrypted_item)
64//!   .send()
65//!   .await?
66//!   .encrypted_item
67//!   .unwrap();
68//!
69//! assert_eq!(decrypted_item, original_item);
70//! ```
71//!
72
73#![allow(warnings, unconditional_panic)]
74#![allow(nonstandard_style)]
75#![allow(clippy::never_loop)]
76#![allow(clippy::absurd_extreme_comparisons)]
77
78/// Client for use with the various low level transform operations
79pub mod client;
80/// Errors and error handling utilities.
81pub mod error;
82/// the DbEsdkInterceptor type for use with the aws_sdk_dynamodb interceptor
83pub mod intercept;
84/// All the transform operations. Rarely useful.
85pub mod operation;
86/// Types for the transform client. Rarely useful.
87pub mod types;
88
89#[cfg(feature = "fips")]
90use aws_lc_fips_sys as aws_lc_sys_impl;
91
92#[cfg(not(feature = "fips"))]
93use aws_lc_sys as aws_lc_sys_impl;
94
95pub use client::Client;
96pub use types::dynamo_db_tables_encryption_config::DynamoDbTablesEncryptionConfig;
97
98/// Configuration types etc.
99pub use crate::deps::aws_cryptography_dbEncryptionSdk_dynamoDb as dynamodb;
100/// Low level interface to encrypt or decrypt individual Items.
101pub use crate::deps::aws_cryptography_dbEncryptionSdk_dynamoDb_itemEncryptor as item_encryptor;
102pub(crate) use crate::deps::aws_cryptography_dbEncryptionSdk_structuredEncryption;
103pub use crate::deps::aws_cryptography_dbEncryptionSdk_structuredEncryption::types::CryptoAction;
104/// Branch key support. See [Key Stores](https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/keystores.html)
105pub use crate::deps::aws_cryptography_keyStore as key_store;
106/// [Key Rings](https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/choose-keyring.html) and other fundamentals.
107pub use crate::deps::aws_cryptography_materialProviders as material_providers;
108/// Rarely needed internal KMS Client, needed for [ClientSupplier](https://github.com/aws/aws-database-encryption-sdk-dynamodb/blob/main/releases/rust/db_esdk/examples/clientsupplier/regional_role_client_supplier.rs)
109pub use crate::deps::com_amazonaws_kms;
110
111mod standard_library_conversions;
112mod standard_library_externs;
113
114pub(crate) use crate::deps::aws_cryptography_primitives;
115
116pub(crate) mod implementation_from_dafny;
117pub(crate) use crate::implementation_from_dafny::_Wrappers_Compile;
118pub(crate) use crate::implementation_from_dafny::software;
119pub(crate) use crate::implementation_from_dafny::AesKdfCtr;
120pub(crate) use crate::implementation_from_dafny::ConcurrentCall;
121pub(crate) use crate::implementation_from_dafny::DafnyLibraries;
122pub(crate) use crate::implementation_from_dafny::ExternDigest;
123pub(crate) use crate::implementation_from_dafny::ExternRandom;
124pub(crate) use crate::implementation_from_dafny::Signature;
125pub(crate) use crate::implementation_from_dafny::Time;
126pub(crate) use crate::implementation_from_dafny::_LocalCMC_Compile;
127pub(crate) use crate::implementation_from_dafny::_StormTracker_Compile;
128pub(crate) use crate::implementation_from_dafny::ECDH;
129pub(crate) use crate::implementation_from_dafny::HMAC;
130pub(crate) use crate::implementation_from_dafny::UTF8;
131pub(crate) use crate::implementation_from_dafny::UUID;
132
133pub(crate) mod conversions;
134pub(crate) mod deps;
135pub(crate) mod validation;
136
137pub(crate) mod aes_gcm;
138pub(crate) mod aes_kdf_ctr;
139pub(crate) mod concurrent_call;
140pub(crate) mod dafny_libraries;
141pub(crate) mod ddb;
142pub(crate) mod digest;
143pub(crate) mod ecdh;
144pub(crate) mod ecdsa;
145pub(crate) mod hmac;
146pub(crate) mod kms;
147pub(crate) mod local_cmc;
148pub(crate) mod oslang;
149pub(crate) mod random;
150pub(crate) mod rsa;
151pub(crate) mod sets;
152pub(crate) mod software_externs;
153pub(crate) mod storm_tracker;
154pub(crate) mod time;
155pub(crate) mod uuid;
aws_db_esdk/lib.rs

aws_db_esdk/
lib.rs
