Struct KmsServiceHook 

pub struct KmsServiceHook { /* private fields */ }

Hook used by service crates that need to call KMS for encryption / decryption without going through the AWS-shaped HTTP layer.

Implementations

impl KmsServiceHook

pub fn new(state: SharedKmsState, usage: SharedKmsUsageState) -> Self

pub fn encrypt( &self, account_id: &str, region: &str, key_id: &str, plaintext: &[u8], service_principal: &str, encryption_context: HashMap<String, String>, ) -> Result<String, KmsHookError>

Encrypt plaintext under key_id (raw id, ARN, alias, or aws/<service> AWS-managed alias). Records the call as a GenerateDataKey-shaped usage record and returns the base64 ciphertext envelope.

pub fn decrypt( &self, account_id: &str, ciphertext_b64: &str, service_principal: &str, encryption_context: HashMap<String, String>, ) -> Result<Vec<u8>, KmsHookError>

Decrypt a previously-encrypt-produced base64 ciphertext. Records the call as a Decrypt-shaped usage record.