|
| 1 | +# AWS Encryption SDK Examples |
| 2 | + |
| 3 | +This section features examples that show you |
| 4 | +how to use the AWS Encryption SDK. |
| 5 | +We demonstrate how to use the encryption and decryption APIs |
| 6 | +and how to set up some common configuration patterns. |
| 7 | + |
| 8 | +## APIs |
| 9 | + |
| 10 | +The AWS Encryption SDK provides two high-level APIs: |
| 11 | +one-step APIs that process the entire operation in memory |
| 12 | +and streaming APIs. |
| 13 | + |
| 14 | +You can find examples that demonstrate these APIs |
| 15 | +in the [`examples`](./java/com/amazonaws/crypto/examples) directory. |
| 16 | + |
| 17 | +## Configuration |
| 18 | + |
| 19 | +To use the encryption and decryption APIs, |
| 20 | +you need to describe how you want the library to protect your data keys. |
| 21 | +You can do this by configuring |
| 22 | +[keyrings](#keyrings) or [cryptographic materials managers](#cryptographic-materials-managers), |
| 23 | +or by configuring [master key providers](#master-key-providers). |
| 24 | +These examples will show you how to use the configuration tools that we include for you |
| 25 | +and how to create some of your own. |
| 26 | +We start with AWS KMS examples, then show how to use other wrapping keys. |
| 27 | + |
| 28 | +* Using AWS Key Management Service (AWS KMS) |
| 29 | + * How to use one AWS KMS CMK |
| 30 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/SingleCmk.java) |
| 31 | + * [with master key providers](./java/com/amazonaws/crypto/examples/masterkeyprovider/awskms/SingleCmk.java) |
| 32 | + * How to use multiple AWS KMS CMKs in different regions |
| 33 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/MultipleRegions.java) |
| 34 | + * [with master key providers](./java/com/amazonaws/crypto/examples/masterkeyprovider/awskms/MultipleRegions.java) |
| 35 | + * How to decrypt when you don't know the CMK |
| 36 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/DiscoveryDecrypt.java) |
| 37 | + * [with master key providers](./java/com/amazonaws/crypto/examples/masterkeyprovider/awskms/DiscoveryDecrypt.java) |
| 38 | + * How to decrypt within a region |
| 39 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/DiscoveryDecryptInRegionOnly.java) |
| 40 | + * How to decrypt with a preferred region but failover to others |
| 41 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/DiscoveryDecryptWithPreferredRegions.java) |
| 42 | + * How to reproduce the behavior of an AWS KMS master key provider |
| 43 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/ActLikeAwsKmsMasterKeyProvider.java) |
| 44 | + * How to use AWS KMS clients with custom configuration |
| 45 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/CustomKmsClientConfig.java) |
| 46 | + * How to use different AWS KMS client for different regions |
| 47 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/awskms/CustomClientSupplier.java) |
| 48 | +* Using raw wrapping keys |
| 49 | + * How to use a raw AES wrapping key |
| 50 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/rawaes/RawAes.java) |
| 51 | + * [with master key providers](./java/com/amazonaws/crypto/examples/masterkeyprovider/rawaes/RawAes.java) |
| 52 | + * How to use a raw RSA wrapping key |
| 53 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/rawrsa/RawRsa.java) |
| 54 | + * [with master key providers](./java/com/amazonaws/crypto/examples/masterkeyprovider/rawrsa/RawRsa.java) |
| 55 | + * How to encrypt with a raw RSA public key wrapping key without access to the private key |
| 56 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/rawrsa/PublicPrivateKeySeparate.java) |
| 57 | + * How to use a raw RSA wrapping key when the key is DER encoded |
| 58 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/rawrsa/RawRsaDerEncoded.java) |
| 59 | +* Combining wrapping keys |
| 60 | + * How to combine AWS KMS with an offline escrow key |
| 61 | + * [with keyrings](./java/com/amazonaws/crypto/examples/keyring/multi/AwsKmsWithEscrow.java) |
| 62 | + * [with master key providers](./java/com/amazonaws/crypto/examples/masterkeyprovider/multi/AwsKmsWithEscrow.java) |
| 63 | +* How to reuse data keys across multiple messages |
| 64 | + * [with the caching cryptographic materials manager](./java/com/amazonaws/crypto/examples/cryptomaterialsmanager/caching/SimpleCache.java) |
| 65 | +* How to restrict algorithm suites |
| 66 | + * [with a custom cryptographic materials manager](./java/com/amazonaws/crypto/examples/cryptomaterialsmanager/custom/AlgorithmSuiteEnforcement.java) |
| 67 | +* How to require encryption context fields |
| 68 | + * [with a custom cryptographic materials manager](./java/com/amazonaws/crypto/examples/cryptomaterialsmanager/custom/RequiringEncryptionContextFields.java) |
| 69 | + |
| 70 | +### Keyrings |
| 71 | + |
| 72 | +Keyrings are the most common way for you to configure the AWS Encryption SDK. |
| 73 | +They determine how the AWS Encryption SDK protects your data. |
| 74 | +You can find these examples in ['examples/keyring`](./java/com/amazonaws/crypto/examples/keyring). |
| 75 | + |
| 76 | +### Cryptographic Materials Managers |
| 77 | + |
| 78 | +Keyrings define how your data keys are protected, |
| 79 | +but there is more going on here than just protecting data keys. |
| 80 | + |
| 81 | +Cryptographic materials managers give you higher-level controls |
| 82 | +over how the AWS Encryption SDK protects your data. |
| 83 | +This can include things like |
| 84 | +enforcing the use of certain algorithm suites or encryption context settings, |
| 85 | +reusing data keys across messages, |
| 86 | +or changing how you interact with keyrings. |
| 87 | +You can find these examples in |
| 88 | +[`examples/crypto_materials_manager`](./java/com/amazonaws/crypto/examples/cryptomaterialsmanager). |
| 89 | + |
| 90 | +### Master Key Providers |
| 91 | + |
| 92 | +Before there were keyrings, there were master key providers. |
| 93 | +Master key providers were the original configuration structure |
| 94 | +that we provided for defining how you want to protect your data keys. |
| 95 | +Keyrings provide a simpler experience and often more powerful configuration options, |
| 96 | +but if you need to use master key providers, |
| 97 | +need help migrating from master key providers to keyrings, |
| 98 | +or simply want to see the difference between these configuration experiences, |
| 99 | +you can find these examples in [`examples/masterkeyprovider`](./java/com/amazonaws/crypto/examples/masterkeyprovider). |
| 100 | + |
| 101 | +## Legacy |
| 102 | + |
| 103 | +This section includes older examples, |
| 104 | +including examples of using master keys and master key providers. |
| 105 | +You can use them as a reference, |
| 106 | +but we recommend looking at the newer examples, which explain the preferred ways of using this library. |
| 107 | +You can find these examples in [`examples/legacy`](./java/com/amazonaws/crypto/examples/legacy). |
| 108 | + |
| 109 | +# Writing Examples |
| 110 | + |
| 111 | +If you want to contribute a new example, that's awesome! |
| 112 | +To make sure that your example is tested in our CI, |
| 113 | +please make sure that it meets the following requirements: |
| 114 | + |
| 115 | +1. The example MUST be a distinct class in the [`examples`](./java/com/amazonaws/crypto/examples) directory. |
| 116 | +1. Each example file MUST contain exactly one example. |
| 117 | +1. Each example file MUST contain a static method called `run` that runs the example. |
| 118 | +1. If your `run` method needs any of the following inputs, |
| 119 | + the parameters MUST have the following types: |
| 120 | + * `com.amazonaws.encryptionsdk.kms.AwsKmsCmkId` : A single AWS KMS CMK ARN. |
| 121 | + * NOTE: You can assume that automatically discovered credentials have |
| 122 | + `kms:GenerateDataKey`, `kms:Encrypt`, and `kms:Decrypt` permissions on this CMK. |
| 123 | + * `List<com.amazonaws.encryptionsdk.kms.AwsKmsCmkId>` : |
| 124 | + A list of AWS KMS CMK ARNs to use for encrypting and decrypting data keys. |
| 125 | + * NOTE: You can assume that automatically discovered credentials have |
| 126 | + `kms:Encrypt` and `kms:Decrypt` permissions on these CMKs. |
| 127 | + * `byte[]` : Plaintext data to encrypt. |
| 128 | + * `java.io.File` : A path to a file containing plaintext to encrypt. |
| 129 | + * NOTE: You can assume that you have write access to the parent directory |
| 130 | + and that anything you do in that directory will be cleaned up |
| 131 | + by our test runners. |
| 132 | +1. Any additional parameters MUST be optional and nullable and not of the same type as the above parameters. |
0 commit comments