Struct KmsEncryptor 

pub struct KmsEncryptor { /* private fields */ }

KeyEncryptor backed by AWS Key Management Service (KMS).

Each encrypt call invokes kms:Encrypt on the configured CMK. KMS manages its own IV internally, so Encrypted::nonce is always None for ciphertexts produced by this encryptor.

decrypt invokes kms:Decrypt; the key_id is embedded in the KMS ciphertext blob and does not need to be supplied again.

Key versioning

version is a caller-controlled label stored in Encrypted::key_version. Increment it whenever you rotate the KMS CMK so that syncers can tell which CMK to use for a given ciphertext at decryption time (if you have multiple encryptors in rotation).

Implementations

impl KmsEncryptor

pub fn new(client: KmsClient, key_id: impl Into<String>, version: u8) -> Self

Create a new KmsEncryptor.

• client — pre-configured KmsClient; region and credentials come from the SDK config
• key_id — ARN, alias, or key ID of the KMS symmetric CMK to use
• version — stored in Encrypted::key_version; use 0 if you have a single CMK

Trait Implementations

impl Clone for KmsEncryptor

fn clone(&self) -> KmsEncryptor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl KeyEncryptor for KmsEncryptor

fn encrypt<'life0, 'life1, 'async_trait>( &'life0 self, plaintext: &'life1 [u8], ) -> Pin<Box<dyn Future<Output = Result<Encrypted, EncryptorError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Encrypt plaintext and return the ciphertext bundle.

fn decrypt<'life0, 'life1, 'async_trait>( &'life0 self, encrypted: &'life1 Encrypted, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, EncryptorError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Decrypt an Encrypted bundle back to plaintext.