2
2
3
3
import java .util .HashMap ;
4
4
import java .util .Map ;
5
-
6
5
import software .amazon .awssdk .core .client .config .ClientOverrideConfiguration ;
7
6
import software .amazon .awssdk .services .dynamodb .DynamoDbClient ;
8
7
import software .amazon .awssdk .services .dynamodb .model .*;
@@ -107,31 +106,28 @@ public static void SharedCacheAcrossHierarchicalKeyringsGetItemPutItem(
107
106
// using the Material Providers Library
108
107
// This CMC takes in:
109
108
// - CacheType
110
- final MaterialProviders matProv =
111
- MaterialProviders .builder ()
112
- .MaterialProvidersConfig (MaterialProvidersConfig .builder ().build ())
113
- .build ();
109
+ final MaterialProviders matProv = MaterialProviders .builder ()
110
+ .MaterialProvidersConfig (MaterialProvidersConfig .builder ().build ())
111
+ .build ();
114
112
115
- final CacheType cache =
116
- CacheType .builder ()
117
- .Default (DefaultCache .builder ().entryCapacity (100 ).build ())
118
- .build ();
113
+ final CacheType cache = CacheType .builder ()
114
+ .Default (DefaultCache .builder ().entryCapacity (100 ).build ())
115
+ .build ();
119
116
120
117
final CreateCryptographicMaterialsCacheInput cryptographicMaterialsCacheInput =
121
- CreateCryptographicMaterialsCacheInput .builder ()
122
- .cache (cache )
123
- .build ();
118
+ CreateCryptographicMaterialsCacheInput .builder ().cache (cache ).build ();
124
119
125
120
final ICryptographicMaterialsCache sharedCryptographicMaterialsCache =
126
- matProv .CreateCryptographicMaterialsCache (cryptographicMaterialsCacheInput );
121
+ matProv .CreateCryptographicMaterialsCache (
122
+ cryptographicMaterialsCacheInput
123
+ );
127
124
128
125
// 2. Create a CacheType object for the sharedCryptographicMaterialsCache
129
126
// Note that the `cache` parameter in the Hierarchical Keyring Input takes a `CacheType` as input
130
- final CacheType sharedCache =
131
- CacheType .builder ()
132
- // This is the `Shared` CacheType that passes an already initialized shared cache
133
- .Shared (sharedCryptographicMaterialsCache )
134
- .build ();
127
+ final CacheType sharedCache = CacheType .builder ()
128
+ // This is the `Shared` CacheType that passes an already initialized shared cache
129
+ .Shared (sharedCryptographicMaterialsCache )
130
+ .build ();
135
131
136
132
// Initial KeyStore Setup: This example requires that you have already
137
133
// created your KeyStore, and have populated it with a new branch key.
@@ -141,11 +137,9 @@ public static void SharedCacheAcrossHierarchicalKeyringsGetItemPutItem(
141
137
// to initially create and populate your KeyStore.
142
138
// Note that keyStoreTableName is the physical Key Store,
143
139
// and keystore1 is instances of this physical Key Store.
144
- final KeyStore keystore1 = KeyStore
145
- .builder ()
140
+ final KeyStore keystore1 = KeyStore .builder ()
146
141
.KeyStoreConfig (
147
- KeyStoreConfig
148
- .builder ()
142
+ KeyStoreConfig .builder ()
149
143
.ddbClient (DynamoDbClient .create ())
150
144
.ddbTableName (keyStoreTableName )
151
145
.logicalKeyStoreName (logicalKeyStoreName )
@@ -161,7 +155,7 @@ public static void SharedCacheAcrossHierarchicalKeyringsGetItemPutItem(
161
155
// the shared Cache and the BranchKeyId.
162
156
// Note that we are now providing an already initialized shared cache instead of just mentioning
163
157
// the cache type and the Hierarchical Keyring initializing a cache at initialization.
164
-
158
+
165
159
// This example creates a Hierarchical Keyring for a single BranchKeyId. You can, however, use a
166
160
// BranchKeyIdSupplier as per your use-case. See the HierarchicalKeyringsExample.java for more
167
161
// information.
@@ -170,8 +164,7 @@ public static void SharedCacheAcrossHierarchicalKeyringsGetItemPutItem(
170
164
// Branch Key ID at the top of this example before creating Hierarchical Keyrings with a Shared Cache.
171
165
// partitionId for this example is a random UUID
172
166
final CreateAwsKmsHierarchicalKeyringInput keyringInput1 =
173
- CreateAwsKmsHierarchicalKeyringInput
174
- .builder ()
167
+ CreateAwsKmsHierarchicalKeyringInput .builder ()
175
168
.keyStore (keystore1 )
176
169
.branchKeyId (branchKeyId )
177
170
.ttlSeconds (600 ) // This dictates how often we call back to KMS to authorize use of the branch keys
@@ -180,7 +173,7 @@ public static void SharedCacheAcrossHierarchicalKeyringsGetItemPutItem(
180
173
.build ();
181
174
final IKeyring hierarchicalKeyring1 =
182
175
matProv .CreateAwsKmsHierarchicalKeyring (keyringInput1 );
183
-
176
+
184
177
// 4. Configure which attributes are encrypted and/or signed when writing new items.
185
178
// For each attribute that may exist on the items we plan to write to our DynamoDbTable,
186
179
// we must explicitly configure how they should be treated during item encryption:
@@ -196,23 +189,27 @@ public static void SharedCacheAcrossHierarchicalKeyringsGetItemPutItem(
196
189
);
197
190
198
191
// 5. Get the DDB Client for Hierarchical Keyring 1.
199
- final DynamoDbClient ddbClient1 = GetDDBClient (ddbTableName , hierarchicalKeyring1 , attributeActionsOnEncrypt );
192
+ final DynamoDbClient ddbClient1 = GetDDBClient (
193
+ ddbTableName ,
194
+ hierarchicalKeyring1 ,
195
+ attributeActionsOnEncrypt
196
+ );
200
197
201
198
// 6. Encrypt Decrypt roundtrip with ddbClient1
202
199
PutGetItems (ddbTableName , ddbClient1 );
203
200
204
201
// Through the above encrypt and decrypt roundtrip, the cache will be populated and
205
202
// the cache entries can be used by another Hierarchical Keyring with the
206
203
// - Same Partition ID
207
- // - Same Logical Key Store Name of the Key Store for the Hierarchical Keyring
204
+ // - Same Logical Key Store Name of the Key Store for the Hierarchical Keyring
208
205
// - Same Branch Key ID
209
206
210
207
// 7. Configure your KeyStore resource keystore2.
211
208
// This SHOULD be the same configuration that you used
212
209
// to initially create and populate your physical KeyStore.
213
210
// Note that keyStoreTableName is the physical Key Store,
214
211
// and keystore2 is instances of this physical Key Store.
215
-
212
+
216
213
// Note that for this example, keystore2 is identical to keystore1.
217
214
// You can optionally change configurations like KMS Client or KMS Key ID based
218
215
// on your use-case.
@@ -224,11 +221,9 @@ public static void SharedCacheAcrossHierarchicalKeyringsGetItemPutItem(
224
221
// - If you set the Logical Key Store Names for K1 and K2 to be different,
225
222
// HK1 (which uses Key Store instance K1) and HK2 (which uses Key Store
226
223
// instance K2) will NOT be able to share cache entries.
227
- final KeyStore keystore2 = KeyStore
228
- .builder ()
224
+ final KeyStore keystore2 = KeyStore .builder ()
229
225
.KeyStoreConfig (
230
- KeyStoreConfig
231
- .builder ()
226
+ KeyStoreConfig .builder ()
232
227
.ddbClient (DynamoDbClient .create ())
233
228
.ddbTableName (keyStoreTableName )
234
229
.logicalKeyStoreName (logicalKeyStoreName )
@@ -248,8 +243,7 @@ public static void SharedCacheAcrossHierarchicalKeyringsGetItemPutItem(
248
243
// Branch Key ID at the top of this example before creating Hierarchical Keyrings with a Shared Cache.
249
244
// partitionId for this example is a random UUID
250
245
final CreateAwsKmsHierarchicalKeyringInput keyringInput2 =
251
- CreateAwsKmsHierarchicalKeyringInput
252
- .builder ()
246
+ CreateAwsKmsHierarchicalKeyringInput .builder ()
253
247
.keyStore (keystore2 )
254
248
.branchKeyId (branchKeyId )
255
249
.ttlSeconds (600 ) // This dictates how often we call back to KMS to authorize use of the branch keys
@@ -260,7 +254,11 @@ public static void SharedCacheAcrossHierarchicalKeyringsGetItemPutItem(
260
254
matProv .CreateAwsKmsHierarchicalKeyring (keyringInput2 );
261
255
262
256
// 9. Get the DDB Client for Hierarchical Keyring 2.
263
- final DynamoDbClient ddbClient2 = GetDDBClient (ddbTableName , hierarchicalKeyring2 , attributeActionsOnEncrypt );
257
+ final DynamoDbClient ddbClient2 = GetDDBClient (
258
+ ddbTableName ,
259
+ hierarchicalKeyring2 ,
260
+ attributeActionsOnEncrypt
261
+ );
264
262
265
263
// 10. Encrypt Decrypt roundtrip with ddbClient2
266
264
PutGetItems (ddbTableName , ddbClient2 );
@@ -304,41 +302,37 @@ public static DynamoDbClient GetDDBClient(
304
302
// Create the DynamoDb Encryption configuration for the table we will be writing to.
305
303
final Map <String , DynamoDbTableEncryptionConfig > tableConfigs =
306
304
new HashMap <>();
307
- final DynamoDbTableEncryptionConfig config = DynamoDbTableEncryptionConfig
308
- .builder ()
309
- .logicalTableName (ddbTableName )
310
- .partitionKeyName ("partition_key" )
311
- .sortKeyName ("sort_key" )
312
- .attributeActionsOnEncrypt (attributeActionsOnEncrypt )
313
- .keyring (hierarchicalKeyring )
314
- .allowedUnsignedAttributePrefix (unsignAttrPrefix )
315
- .build ();
305
+ final DynamoDbTableEncryptionConfig config =
306
+ DynamoDbTableEncryptionConfig .builder ()
307
+ .logicalTableName (ddbTableName )
308
+ .partitionKeyName ("partition_key" )
309
+ .sortKeyName ("sort_key" )
310
+ .attributeActionsOnEncrypt (attributeActionsOnEncrypt )
311
+ .keyring (hierarchicalKeyring )
312
+ .allowedUnsignedAttributePrefix (unsignAttrPrefix )
313
+ .build ();
316
314
tableConfigs .put (ddbTableName , config );
317
315
318
316
// Create the DynamoDb Encryption Interceptor
319
317
DynamoDbEncryptionInterceptor encryptionInterceptor =
320
- DynamoDbEncryptionInterceptor
321
- .builder ()
318
+ DynamoDbEncryptionInterceptor .builder ()
322
319
.config (
323
- DynamoDbTablesEncryptionConfig
324
- .builder ()
320
+ DynamoDbTablesEncryptionConfig .builder ()
325
321
.tableEncryptionConfigs (tableConfigs )
326
322
.build ()
327
323
)
328
324
.build ();
329
325
330
326
// Create a new AWS SDK DynamoDb client using the DynamoDb Encryption Interceptor above
331
- final DynamoDbClient ddbClient = DynamoDbClient
332
- .builder ()
327
+ final DynamoDbClient ddbClient = DynamoDbClient .builder ()
333
328
.overrideConfiguration (
334
- ClientOverrideConfiguration
335
- .builder ()
329
+ ClientOverrideConfiguration .builder ()
336
330
.addExecutionInterceptor (encryptionInterceptor )
337
331
.build ()
338
332
)
339
333
.build ();
340
-
341
- return ddbClient ;
334
+
335
+ return ddbClient ;
342
336
}
343
337
344
338
public static void PutGetItems (
@@ -359,8 +353,7 @@ public static void PutGetItems(
359
353
AttributeValue .builder ().s ("encrypt and sign me!" ).build ()
360
354
);
361
355
362
- final PutItemRequest putRequest = PutItemRequest
363
- .builder ()
356
+ final PutItemRequest putRequest = PutItemRequest .builder ()
364
357
.tableName (ddbTableName )
365
358
.item (item )
366
359
.build ();
@@ -377,14 +370,10 @@ public static void PutGetItems(
377
370
// BranchKeyIdSupplier as per your use-case. See the HierarchicalKeyringsExample.java for more
378
371
// information.
379
372
final HashMap <String , AttributeValue > keyToGet = new HashMap <>();
380
- keyToGet .put (
381
- "partition_key" ,
382
- AttributeValue .builder ().s ("id" ).build ()
383
- );
373
+ keyToGet .put ("partition_key" , AttributeValue .builder ().s ("id" ).build ());
384
374
keyToGet .put ("sort_key" , AttributeValue .builder ().n ("0" ).build ());
385
375
386
- final GetItemRequest getRequest = GetItemRequest
387
- .builder ()
376
+ final GetItemRequest getRequest = GetItemRequest .builder ()
388
377
.key (keyToGet )
389
378
.tableName (ddbTableName )
390
379
.build ();
0 commit comments